Topic starter
02/02/2026 10:04 pm
TL;DR: Zero Trust adoption is already underway for most organisations, but StrongDM’s guide shows that implementation still depends on disciplined identity assessment, phased rollout, least privilege, micro-segmentation, and continuous measurement. The security model fails when teams treat it as a checklist instead of an operating discipline.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “How to Implement Zero Trust (Step-by-Step Guide)”.
By the numbers:
- More than 86% of organizations have already begun implementing zero trust, according to Cisco.
Key questions
Q: What breaks when Zero Trust is implemented without identity governance?
A: Zero Trust breaks when the policy engine is enforcing stale or incomplete identity data.
Q: Why do standing privileges undermine Zero Trust programmes?
A: Standing privileges undermine Zero Trust because they allow access to exist before it is needed and continue after the work is complete.
Q: What are the signs that a zero trust rollout is failing in practice?
A: Common warning signs include overlapping tools that do not integrate well, inconsistent policy enforcement across environments, weak visibility into asset and transaction flows, and users bypassing controls because processes are too cumbersome.
Practitioner guidance
- Assess users, devices, apps, and services together Create a complete access inventory that maps who or what needs access, what they need, and which systems they touch.
- Prioritise phased rollout around high-risk assets Start with the most sensitive data and systems, then expand zero trust in stages.
- Reduce standing privilege and move toward JIT access Remove persistent access where the role does not require it, especially for privileged and high-impact environments.
Bottom line: Zero trust becomes weak when organisations implement it as a checklist instead of a governed access model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 15 minutes ago by NHI Mgmt Group
07/10/2026 9:37 pm
Zero trust fails first as a governance problem, not a technology problem: the architecture depends on disciplined identity assessment, phased rollout, and continuous measurement. When organisations treat it as a feature deployment, they usually preserve the very access paths the model is supposed to shrink. Practitioners should read implementation maturity as the real control, not the branding of the toolset.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: Should security teams prioritise micro-segmentation or least privilege first?
A: They should treat them as linked controls, but prioritise the greatest exposure first. Least privilege limits what an identity can do after access is granted, while micro-segmentation limits where it can move. In practice, the best sequence is usually to narrow high-risk access first, then constrain network paths around those assets.
👉 Read our full editorial: Zero trust implementation gaps still undermine identity governance