Notifications
Clear all
Topic starter
11/06/2026 11:38 pm
TL;DR: Most organisations that claim to have “done” Zero Trust still leave major gaps in identity, device, network, privileged access, and visibility, according to JumpCloud. The gap is not the framework itself but the tendency to stop after MFA and conditional access, leaving governance incomplete and client risk unresolved.
NHIMG editorial — based on content published by JumpCloud: Zero Trust gap analysis map for identifying programme blind spots
By the numbers:
- The majority of IT professionals expect their engagements to dive more into strategic IT planning (58%) and expand into new service areas (53%).
Questions worth separating out
Q: How should organisations use a Zero Trust gap analysis in practice?
A: Use it as a governance tool to identify which control families are incomplete, who owns them, and what to remediate first.
Q: Why do MFA and conditional access not equal Zero Trust?
A: Because they only address the first trust decision at sign-in.
Q: What breaks when Zero Trust stops at the authentication layer?
A: The organisation loses the ability to prove that access was appropriate, bounded, and still valid after context changes.
Practitioner guidance
- Map Zero Trust controls to one governance view Score identity, device, network, privileged access, and visibility in the same worksheet so gaps are visible as a system problem rather than isolated tickets.
- Separate authentication from authorisation Review every area where MFA is being treated as evidence of complete Zero Trust and check whether access scope, entitlement review, and runtime monitoring are actually in place.
- Use readiness scoring to sequence remediation Turn the gap analysis into a list of owners, deadlines, and next control decisions so the score drives investment rather than becoming a static report.
What's in the full article
JumpCloud's full blog covers the operational detail this post intentionally leaves for the source:
- A copyable Google Sheets workflow for running the Zero Trust Gap Analysis Map across client accounts.
- The exact checklist structure across identity, device, network, privileged access, and visibility.
- Practical guidance for using the map in quarterly business reviews and prospect discovery.
- The companion eBook angle that turns checklist results into client-ready messaging.
👉 Read JumpCloud's guide to using the Zero Trust gap analysis map →
Zero Trust gap analysis: where do most programmes still fall short?
Explore further
12/06/2026 8:24 am
Zero Trust gap analysis is really identity governance triage. The useful part of the map is not the worksheet itself but the way it forces organisations to confront whether identity, privileged access, device trust, network control, and visibility are being governed as one system. Programmes that only harden login are not operating Zero Trust, they are operating partial trust with better branding. The practitioner implication is to treat the gap map as an inventory of governance debt, not a maturity score.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- 59.8% of organisations see value in a solution that simplifies non-human access management and introduces dynamic ephemeral credentials.
A question worth separating out:
Q: Which identity controls matter most in a Zero Trust programme?
A: Identity governance, privileged access, and runtime visibility are the controls that determine whether Zero Trust is real or just sign-in hardening. If those controls are not aligned, the programme can authenticate users while still failing to constrain what they can do.
👉 Read our full editorial: Zero Trust gap analysis exposes where security programmes stall
