Topic starter
25/06/2026 1:12 am
TL;DR: Stolen credentials can make external breaches look like insider access, according to Bravura Security. Zero Trust Architecture needs lifecycle governance and contextual policy, not just boundary controls, to keep access decisions tied to current entitlement.
Editorial analysis by NHI Mgmt Group, based on content published by Bravura Security: “Expert Zero Trust Paths 2025: IAM, SDP & Segmentation”.
By the numbers:
- By 2025, 81% of breaches were caused by external actors, according to Bravura Security.
Key questions
Q: How should security teams implement zero trust IAM in cloud-native environments?
A: Start by enforcing real-time authorization on every privileged request, then replace standing access with scoped, time-bound elevation.
Q: What are the signs that network-centric zero trust is not keeping up?
A: Common signals include heavy reliance on static internal segments, repeated exceptions for cloud and SaaS access, and access decisions that ignore lifecycle state.
Q: Why do perimeter-based zero trust models fail when credentials are stolen or phished?
A: Perimeter-based models assume the boundary is a meaningful trust divider, but stolen or phished credentials let attackers operate as legitimate users once inside.
Practitioner guidance
- Prioritise identity governance in Zero Trust planning Make access lifecycle, approval, and deprovisioning the starting point for ZTA design, then layer segmentation where it still adds value.
- Map credential abuse into your trust model Assume external attackers will arrive with valid credentials and test whether your controls can detect and contain that condition inside the trust boundary.
- Use contextual policy for access decisions Tie access to user, device, resource, and session context so authorization is evaluated dynamically rather than by network location alone.
Bottom line: Zero Trust becomes more durable when identity governance, not perimeter design, carries the main access decision.
Glossary terms: Zero Trust, Identity Governance, Contextual Access Control, Just-in-Time Access Request
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 18 hours ago by NHI Mgmt Group
25/06/2026 10:27 am
Identity governance is now the most defensible Zero Trust control plane for large enterprises. Micro-segmentation and software-defined perimeters still matter, but they depend on stable boundaries that modern SaaS and cloud estates no longer guarantee. The governing question is who should have access, for how long, and under what context, which is the problem identity governance is built to answer. Practitioners should treat ZTA as an access governance programme first and a network design problem second.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise identity governance before micro-segmentation in Zero Trust?
A: In most hybrid and cloud-first environments, yes. Identity governance addresses who gets access and whether that access still makes sense, while segmentation mainly constrains where traffic can go. If the underlying identity model is weak, segmentation often just contains bad access rather than preventing it.
👉 Read our full editorial: Identity governance is the strongest path to zero trust today