Topic starter
08/02/2026 10:23 pm
TL;DR: Perimeter-based security fails when 60% of breaches involve valid credentials, and non-human identities now outnumber human identities by as much as 45-to-1, according to CyberArk. Identity has become the real control point for Zero Trust, because attackers increasingly bypass vulnerabilities and operate through trusted accounts.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “How CISOs Can Use Identity to Advance Zero Trust”.
By the numbers:
- 60% of breaches now involve valid credentials, which makes identity the practical decision point for Zero Trust.
- The total of non-human identities outnumbers human identities by as much as 45-to-1, according to CyberArk.
- The average organization expects identities to surge by 3x in the next 12 months.
Key questions
Q: What breaks when Zero Trust is implemented without identity governance?
A: Zero Trust breaks when the policy engine is enforcing stale or incomplete identity data.
Q: When does machine identity risk become a zero trust problem?
A: It becomes a zero trust problem when credentials are persistent, widely reusable, or hard to verify at runtime.
Q: What are the signs that identity controls are not supporting zero trust as intended?
A: Common signs include accounts not using MFA, service accounts being reused for user access, identity stores outside admin control, and assets being accessed through paths that bypass ZTNA or PAM policy.
Practitioner guidance
- Map machine identities as critical assets Build an inventory of service accounts, API keys, tokens, certificates, and other non-human identities, then assign ownership and business purpose to each one.
- Tie privileged access to time-bounded issuance Use just-in-time access and zero standing privileges for human and machine administration paths so elevated rights do not persist beyond the task.
- Align identity governance with access enforcement Connect access reviews, RBAC, ABAC, and lifecycle controls to the same authoritative identity data so policy decisions stay current across joiners, movers, and leavers.
Bottom line: Perimeter security is weaker than identity-based control when valid credentials are already enough to enter an environment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:08 pm
Identity is now the control plane, not a supporting control. CyberArk’s core argument is that perimeter logic fails once valid credentials are the dominant access path. That shifts Zero Trust from a network-centred model to an identity-centred operating model across humans, services, and machine identities. The implication is that identity governance now determines whether Zero Trust can be enforced at all.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security leaders govern human and machine access together?
A: Use one governance model that covers onboarding, role changes, offboarding, privilege elevation, and certification for both humans and NHIs. Separate workflows create blind spots, but shared identity data and policy enforcement let IAM, PAM, and NHI controls support the same Zero Trust objective.
👉 Read our full editorial: Identity-first zero trust: why CISOs must center machine identities