Topic starter
11/07/2026 1:58 pm
TL;DR: Zero Trust still breaks where access is actually used, Zero Networks reports, because policy is not being enforced across the places attackers can move. Identity-aware enforcement has to reach apps, cloud services, and machine identities to cut lateral movement and contain breach impact.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “Implementing Zero Trust: How to Operationalize NSA Guidelines”.
By the numbers:
- The NSA’s Zero Trust Implementation Guidelines cover 91 activities across five modular phases.
- 88% of CISOs have experienced significant challenges in their Zero Trust implementation attempts.
Key questions
Q: Why does Zero Trust adoption stall even when organisations agree with the model?
A: Adoption often stalls because the easiest option is to do nothing.
Q: What are the signs that a zero trust rollout is failing in practice?
A: Common warning signs include overlapping tools that do not integrate well, inconsistent policy enforcement across environments, weak visibility into asset and transaction flows, and users bypassing controls because processes are too cumbersome.
Q: What breaks when Zero Trust only covers login and privileged access?
A: Security gaps remain in applications, cloud services, and machine identities that are not subject to the same verification discipline.
Practitioner guidance
- Tie identity to network enforcement Move privileged and sensitive internal access decisions to enforcement points that evaluate identity, device and context together instead of only at login.
- Remove implicit internal trust Default-deny east-west traffic and explicitly approve internal communications that are required for business function, including system-to-system flows.
- Automate segmentation policy lifecycle Use automation to keep segmentation boundaries and access rules aligned with live traffic patterns so policy does not drift as systems change.
Bottom line: Zero Trust is still failing in many organisations because the architecture is not being enforced where access is actually used.
Glossary terms: Zero Trust, Blast Radius, Identity-Aware Enforcement, Continuous Verification
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 hours ago by NHI Mgmt Group
11/07/2026 2:08 pm
Zero Trust fails when organisations confuse adoption with enforcement: The article shows that broad agreement on Zero Trust does not solve the operational gap between architecture language and implementable controls. That gap is visible whenever identity and network policy remain separate, because internal trust still exists even when the perimeter has been modernised. Practitioners should treat Zero Trust as an enforcement model, not an intent statement.
A few things that frame the scale:
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: Should organisations prioritise identity governance before micro-segmentation in Zero Trust?
A: In most hybrid and cloud-first environments, yes. Identity governance addresses who gets access and whether that access still makes sense, while segmentation mainly constrains where traffic can go. If the underlying identity model is weak, segmentation often just contains bad access rather than preventing it.
👉 Read our full editorial: NSA Zero Trust guidelines expose the operational gap in ZT