Topic starter
14/09/2026 10:09 am
TL;DR: Zero trust fails in practice when organisations try to layer continuous verification onto legacy estates, fragmented policies, and poor user experience, according to Versasec. The real constraint is identity design, because zero trust only works when authentication, device trust, and access governance can be enforced consistently across every path.
Editorial analysis by NHI Mgmt Group, based on content published by Versasec: “The Uncomfortable Truth About Zero Trust (And How to Fix It)”.
Key questions
Q: What breaks when legacy identity systems are ignored in OT zero trust programmes?
A: If legacy identity sources are bypassed, organisations often create shadow processes, manual exceptions, or brittle migrations that weaken governance.
Q: Why do zero trust programmes create so much user friction?
A: They usually layer repeated verification on top of workflows that were never designed for frequent re-authentication, especially where applications, sessions, and access paths are fragmented.
Q: What are the signs that identity controls are not supporting zero trust as intended?
A: Common signs include accounts not using MFA, service accounts being reused for user access, identity stores outside admin control, and assets being accessed through paths that bypass ZTNA or PAM policy.
Practitioner guidance
- Map identity enforcement gaps across the estate Inventory where continuous verification cannot be applied consistently across on-premises, cloud, and legacy applications.
- Reduce re-authentication churn Review where repeated prompts are causing users to delay work, share accounts, or adopt unsanctioned alternatives.
- Standardise on stronger authentication for high-friction paths Use passwordless MFA or equivalent phishing-resistant authentication where repeated credential entry is creating support load and user resistance.
Bottom line: Zero trust often fails because identity and authentication paths are inconsistent across the estate, not because the concept is flawed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
Zero trust fails first at the identity layer, not the policy layer. The article shows that continuous verification is only as strong as the authentication and authorisation paths underneath it. When those paths are fragmented across legacy and cloud systems, policy coherence collapses into exception handling. For practitioners, the control problem is consistency, not doctrine.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise identity governance before micro-segmentation in Zero Trust?
A: In most hybrid and cloud-first environments, yes. Identity governance addresses who gets access and whether that access still makes sense, while segmentation mainly constrains where traffic can go. If the underlying identity model is weak, segmentation often just contains bad access rather than preventing it.
👉 Read our full editorial: Zero trust’s hidden cost is identity complexity, not just policy