Topic starter
18/08/2026 2:39 pm
TL;DR: Zero Trust data security now has to evaluate access for users, service accounts, workloads, and AI systems across cloud, SaaS, and on-premises environments, according to BigID. The model only works when identity, context, data sensitivity, and continuous monitoring replace perimeter trust assumptions, and that means NHI governance can no longer sit outside IAM design.
Editorial analysis by NHI Mgmt Group, based on content published by BigID: “Zero Trust Data Security: How to Protect Sensitive Data Everywhere”.
Key questions
Q: What breaks when zero trust stays focused on the network instead of the data?
A: Zero trust becomes incomplete when it treats network location or prior authentication as proof of trust.
Q: Why do service accounts and AI systems create extra risk in zero trust models?
A: Because their privileges are often broader, inherited, and less visible than human access.
Q: How do you know if zero trust is actually working for data?
A: Zero trust is working for data only when the organisation can show that sensitive information stays within defined use boundaries after access is granted.
Practitioner guidance
- Map sensitive data to actual access paths Build a current inventory of where sensitive data lives and which identities, human and non-human, can reach it through direct, inherited, or indirect permissions.
- Tighten privileges for service accounts and AI systems Review effective access for service accounts, workloads, applications, and AI systems, then remove permissions that exceed the task or dataset they need.
- Use data sensitivity in authorization decisions Apply stronger controls when access requests target regulated, personal, financial, or proprietary data, even if the identity already authenticated successfully.
Bottom line: Zero trust data security only works when access decisions are tied to data sensitivity, context, and behaviour instead of inherited trust from the network.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:23 pm
Zero trust data security fails if it stays network-centric: The old assumption was that authenticated users or devices inside the perimeter could be trusted to behave appropriately. That assumption breaks when sensitive data sits in cloud services, SaaS platforms, on-premises stores, and AI workflows that are accessed by both humans and non-human identities. Practitioners should treat data itself as the control boundary.
A few things that frame the scale:
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: When should organisations prioritise data classification over broader security tooling?
A: Prioritise data classification first when the main challenge is inconsistent protection across different data types. Classification gives every later control a target, including access rules, encryption, retention, and backup decisions. Without it, teams often apply controls unevenly, overprotect low risk data, and underprotect sensitive records that need tighter handling.
👉 Read our full editorial: Zero trust data security now has to govern AI systems and NHIs