Topic starter
22/06/2026 3:41 pm
TL;DR: IBM’s 2022 analysis says organisations without Zero Trust incur $1M higher breach costs, yet 59% still lack a comprehensive strategy, while EmpowerID’s healthcare example shows the bigger shift is business velocity, not just improved security. The real test is whether Zero Trust removes access friction without creating new governance blind spots.
Editorial analysis by NHI Mgmt Group, based on content published by EmpowerID: “Beyond Perimeter Security: What Zero Trust Actually Enables in Practice”.
By the numbers:
- Organizations without Zero Trust incur $1M higher breach costs, according to IBM's 2022 analysis cited by EmpowerID.
- 59% still haven't deployed a comprehensive Zero Trust strategy.
Key questions
Q: How should security teams measure Zero Trust success beyond breach reduction?
A: Teams should measure Zero Trust across both risk and operations.
A: The model stops being enforceable once controls are only partially deployed, inconsistently managed, or poorly monitored.
Q: Why do disconnected IAM, PAM, and access management tools slow Zero Trust adoption?
A: Disconnected tools create separate decisions, separate audit trails, and separate exceptions, so every access request has to pass through multiple policy points.
Practitioner guidance
- Measure access friction as a governance metric Track time lost to approvals, repeated logins, and escalations so Zero Trust is judged against business flow as well as security outcomes.
- Replace standing privilege with task-scoped elevation Design privilege issuance so administrators and operators receive access only when a task requires it, then lose it automatically when the task ends.
- Unify policy decisions across IGA, PAM, and access management Review whether identity, privilege, and access approvals are being decided in one control plane or across disconnected tools that create blind spots.
Bottom line: Zero Trust changes more than attack surface because it can remove access friction that slows business teams and partner integrations.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 3:45 pm
Zero Trust only works as an operating model when it changes access economics, not just security posture. The article's healthcare example shows that the clearest benefit was not simply lower exposure but faster movement across business processes. That means the identity programme is being judged on whether it removes approval drag while preserving control. Practitioners should treat access friction as a governance metric, not just a user-experience problem.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should security teams do first when Zero Trust starts creating too much approval friction?
A: Start by mapping where delay is coming from, then identify which approvals are truly risk-based and which are legacy process. In many environments the friction comes from duplicative gates rather than actual security need. Removing those redundant checkpoints improves business velocity without weakening access governance.
👉 Read our full editorial: Zero Trust architecture is changing more than breach risk