Topic starter
18/08/2026 2:39 pm
TL;DR: Access decisions for sensitive data only hold when identity, context, sensitivity, and behaviour replace inherited network trust, according to BigID. Data-centric zero trust needs one model that unifies IAM, NHI governance, monitoring, and remediation.
Editorial analysis by NHI Mgmt Group, based on content published by BigID: “Zero Trust Data Security: How to Protect Sensitive Data Everywhere”.
Key questions
Q: Why do service accounts and AI systems create extra risk in zero trust models?
A: Because their privileges are often broader, inherited, and less visible than human access.
Q: How do you know if zero trust is actually working for data?
A: Zero trust is working for data only when the organisation can show that sensitive information stays within defined use boundaries after access is granted.
Q: What breaks when zero trust stays focused on the network instead of the data?
A: Zero trust becomes incomplete when it treats network location or prior authentication as proof of trust.
Practitioner guidance
- Map sensitive data to actual access paths Build a current inventory of where sensitive data lives and which identities, human and non-human, can reach it through direct, inherited, or indirect permissions.
- Tighten privileges for service accounts and AI systems Review effective access for service accounts, workloads, applications, and AI systems, then remove permissions that exceed the task or dataset they need.
- Use data sensitivity in authorization decisions Apply stronger controls when access requests target regulated, personal, financial, or proprietary data, even if the identity already authenticated successfully.
Bottom line: Zero trust data security only works when access decisions are tied to data sensitivity, context, and behaviour instead of inherited trust from the network.
Glossary terms: Data-centric zero trust, Effective Access, Non-Human Identity (NHI), Continuous authorization
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 15 hours ago by NHI Mgmt Group
18/08/2026 3:23 pm
Zero trust data security fails if it stays network-centric: The old assumption was that authenticated users or devices inside the perimeter could be trusted to behave appropriately. That assumption breaks when sensitive data sits in cloud services, SaaS platforms, on-premises stores, and AI workflows that are accessed by both humans and non-human identities. Practitioners should treat data itself as the control boundary.
A few things that frame the scale:
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: When should organisations prioritise data classification over broader security tooling?
A: Prioritise data classification first when the main challenge is inconsistent protection across different data types. Classification gives every later control a target, including access rules, encryption, retention, and backup decisions. Without it, teams often apply controls unevenly, overprotect low risk data, and underprotect sensitive records that need tighter handling.
👉 Read our full editorial: Zero trust data security now has to govern AI systems and NHIs