Topic starter
08/02/2026 9:54 pm
TL;DR: Credential abuse starts about 22% of breach paths, ahead of vulnerability exploitation at 20%, because attackers often use access that already exists instead of breaking in, according to Apono. The governance gap is post-authentication control: access must be verified, time-bound, and auditable across people and non-human identities.
Editorial analysis by NHI Mgmt Group, based on content published by Apono: “Top 10 Zero Trust Solutions”.
By the numbers:
- Credential abuse starts about 22% of breach paths, ahead of vulnerability exploitation at 20%, because attackers often use access that already exists instead of breaking in.
Key questions
Q: What breaks when Zero Trust stops at authentication?
A: Zero Trust breaks when teams stop at authentication because proving identity does not automatically define what that identity may do.
Q: Why do standing permissions increase breach risk even when MFA is in place?
A: MFA protects the login event, but it does not remove access that already exists after authentication.
Q: How do teams know if Zero Trust is actually improving access control?
A: Look for runtime evidence, not policy statements.
Practitioner guidance
- Tighten post-authentication enforcement Move access checks to the moment of use, not only the moment of login.
- Replace standing permissions with expiry Make privileged access time-bound by default so permissions disappear when the task ends.
- Bring NHIs into the same access model Include service accounts, automation, tokens, and keys in the same governance rules you apply to human access.
Bottom line: Zero trust fails when teams stop at authentication and leave access standing after login.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/10/2026 9:03 pm
Post-authentication access is the real zero trust control plane: Zero trust fails when teams treat login as the security event and everything after it as trusted execution. That assumption breaks because most operational risk emerges from access that persists beyond the moment of authentication. The discipline has to shift to governing entitlement use, not just identity proofing.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams implement Zero Trust for non-human identities?
A: Start by inventorying every machine identity, assigning an owner, and mapping its access to a specific business function. Then apply least privilege, short-lived credentials, and revocation controls so each identity can be verified, limited, and retired on schedule. Zero Trust fails when machine access is treated as permanent infrastructure rather than governed identity.
👉 Read our full editorial: Zero trust solutions are failing where access persists after login