Topic starter
11/06/2026 11:38 pm
TL;DR: Most organisations that claim to have “done” Zero Trust still leave major gaps in identity, device, network, privileged access, and visibility, according to JumpCloud. The gap is not the framework itself but the tendency to stop after MFA and conditional access, leaving governance incomplete and client risk unresolved.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “Turn Zero Trust Gaps Into Growth: A Practical Tool for MSPs”.
Key questions
Q: What breaks when a Zero Trust programme stops after MFA?
A: When Zero Trust stops after MFA, the organisation gets a narrow authentication control but not continuous verification across identity, device, network, privileged access and visibility.
Q: Why do partial MFA deployments still leave Zero Trust programs exposed?
A: Because MFA only reduces risk when the highest-value identities are actually covered.
Q: How can security teams tell whether zero trust is actually working in AWS?
A: Look for evidence that access is issued for a narrow purpose, expires automatically, and is auditable across accounts and resource types.
Practitioner guidance
- Map Zero Trust by control domain Assess identity, device, network, privileged access and visibility separately so that partial deployment is visible rather than implied away by a single MFA rollout.
- Score each environment against operational readiness Use a simple status model such as fully implemented, partially in progress or not in place to expose where the programme has stalled and where remediation should start.
- Test privileged access as a gating control Review whether elevated access is still persistent or poorly monitored, because Zero Trust cannot be considered complete while privileged pathways remain weakly governed.
Bottom line: Zero Trust programmes often stall when organisations equate MFA with completion instead of measuring coverage across the full access path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 8:24 am
Zero Trust fails most often at the point where organisations mistake partial deployment for programme completion. MFA and conditional access are necessary controls, but they do not by themselves establish continuous verification across the full access path. The discipline breaks down when leaders stop measuring coverage by control domain and start measuring it by project completion, which leaves unmanaged devices, network exposure and privileged access gaps in place.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations use a Zero Trust gap analysis in practice?
A: Use it as a governance tool to identify which control families are incomplete, who owns them, and what to remediate first. The value is not in the score itself but in making identity, privileged access, device posture, network, and visibility measurable in one view.
👉 Read our full editorial: Zero Trust gap analysis exposes where security programmes stall
This post was modified 4 days ago by NHI Mgmt Group