Topic starter
12/02/2026 8:44 pm
TL;DR: Zero trust cannot be enforced without identity and access management because every access decision still depends on authenticated identities, role scoping, and continual validation, according to StrongDM and Gartner commentary cited in the post. The practical issue is not the slogan, but whether organisations can operationalise least privilege across users, partners, and systems without manual drift.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “You Can't Have Zero Trust Without Identity and Access Management”.
Key questions
Q: What breaks when Zero Trust is implemented without identity governance?
A: Zero Trust breaks when the policy engine is enforcing stale or incomplete identity data.
Q: Why does least privilege matter so much in Zero Trust and cloud security programmes?
A: Least privilege matters because it limits what any account, workload, or service can do if it is misused or compromised.
Q: How can security teams tell whether zero trust is actually working in AWS?
A: Look for evidence that access is issued for a narrow purpose, expires automatically, and is auditable across accounts and resource types.
Practitioner guidance
- Define identity sources for every access path Map each resource to the authoritative identity store, approval path, and role model that should govern access.
- Classify access by role and task need Separate internal staff, external partners, and service access, then assign the narrowest permissions that support each task.
- Replace manual exceptions with governed review Track every exception, custom role, and standing permission in a recurring access review cycle.
Bottom line: Zero trust depends on current identity and access decisions, not on perimeter assumptions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/10/2026 9:36 pm
Zero trust is an identity governance model before it is a network strategy. The article is right to place authentication and authorisation at the centre because zero trust cannot function if identities are not governed with precision. The practical conclusion is that network segmentation alone never closes the governance gap; identity does.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: What is the difference between least privilege and zero trust?
A: Least privilege limits what an identity can do after access is granted, while zero trust decides whether access should be granted in the first place and keeps checking it over time. In practice, zero trust uses least privilege as one control, but it also depends on identity verification, device posture, segmentation, and continuous monitoring.
👉 Read our full editorial: Zero trust depends on identity and access management discipline