Topic starter
12/06/2026 10:10 pm
TL;DR: Zero trust reduces implicit trust by requiring verification, device checks, encryption, least privilege, monitoring, and periodic access review, according to Axiad. The governance problem remains the same: programmes that ignore permission creep and access sprawl still leave identity attack surface open.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “How to Implement Zero Trust in Your Business”.
Key questions
Q: What breaks when permission creep is not controlled in a zero-trust programme?
A: The model stops being dynamic and becomes a new wrapper for old standing access.
Q: Why do MFA and device checks not solve permission creep risk?
A: MFA and device posture checks verify who or what is asking for access, but they do not reduce excessive permissions already granted.
Q: How should security teams modernize access reviews in zero trust programmes?
A: They should move from broad, calendar-based approvals to evidence-based reviews that focus on actual usage, role fit, and exception handling.
Practitioner guidance
- Audit entitlement growth patterns Identify where roles, group memberships, and exceptions have expanded beyond current job requirements, then flag those paths as zero trust exceptions requiring cleanup.
- Separate authentication from authorization governance Keep MFA and device verification in place, but add a distinct entitlement review process so excessive access is not mistaken for trusted access.
- Tighten role definitions before recertification Reduce broad or inherited roles before access review cycles so recertification validates current business need instead of preserving historical sprawl.
Bottom line: Permission creep is the practical reason many zero trust programmes underperform, because access expands faster than governance catches it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 12:45 am
Permission creep is a zero trust failure mode, not a side effect. A zero trust programme can be architecturally sound at the point of authentication and still collapse in practice if users accumulate access over time. That accumulated privilege creates an identity attack surface that the initial trust decision never intended. Practitioners should treat entitlement growth as a governance defect with security impact, not as a routine admin issue.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: What is the difference between zero trust authentication and entitlement governance?
A: Authentication verifies the identity and the device at the point of access. Entitlement governance controls what that identity can do after access is granted, which is where permission creep appears. Zero trust needs both, but they solve different parts of the trust problem.
👉 Read our full editorial: Zero trust implementation still fails on permission creep
This post was modified 6 days ago by NHI Mgmt Group