Topic starter
19/12/2025 11:30 am
TL;DR: Most zero-trust programmes still stop at network boundaries, while workloads now authenticate across clouds, containers, and AI-driven workflows, according to Aembit’s analysis. Identity-first access is the missing control plane because static credentials, proxy termination, and partial policy enforcement leave non-human identities exposed to lateral movement and overreach.
Editorial analysis by NHI Mgmt Group, based on content published by Aembit: “Zero-Trust Architecture: How to Move From Network Security to Identity-First Access”.
Key questions
Q: What breaks when healthcare zero trust is applied only at the network layer?
A: It leaves the actual identity and session risks untouched.
Q: Why do long-lived workload credentials weaken zero-trust architecture?
A: Long-lived credentials create a reusable trust object that can outlive the request it was meant to support.
Q: How can security teams tell if workload identity is actually being preserved?
A: Look for identity continuity across every hop, not just at launch.
Practitioner guidance
- Audit identity loss points in your access path Map where workload identity disappears at proxies, load balancers, service mesh exits and gateway hops.
- Replace standing secrets with task-scoped issuance Move service accounts and automation flows off long-lived API keys, passwords and persistent tokens.
- Enforce request-level authorization at every hop Require each service boundary to re-evaluate the workload identity and the requested action instead of trusting an upstream network decision.
Bottom line: Workload zero trust fails when identity is validated only at the network edge and then lost at proxies, tunnels or service boundaries.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago by Abdelrahman
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:23 pm
Identity-first zero trust is the correct model for workloads because network trust cannot prove actor identity. Zero trust was designed to remove implicit trust from the perimeter, but many implementations still stop at the transport layer. Once identity is lost at proxy termination or tunnel exit, the programme has preserved encryption without preserving governance. Practitioners should treat end-to-end workload identity as the control objective, not a nice-to-have overlay.
A few things that frame the scale:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- 30.9% of organisations store long-term credentials directly in code, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should teams choose identity-first access over network segmentation for workloads?
A: Choose identity-first access when workloads cross clouds, containers or external APIs and network boundaries no longer represent a meaningful trust zone. Segmentation can still reduce exposure, but it cannot prove which workload is making the request. Identity-first controls are the better fit when access decisions must follow the request itself.
👉 Read our full editorial: Identity-first zero trust for workloads: where network controls fail