Mobile carriers should treat zero trust as an operating model, not a label. That means verifying users and devices continuously, limiting lateral movement with segmentation, and reducing trust in internal networks. In a carrier environment, the priority is to protect customer data, customer service workflows, and API paths while pairing identity controls with monitoring and routine audit evidence.
Why zero trust has to become a carrier operating model
For mobile carriers, zero trust only works when it is applied to customer data paths, internal service workflows, and the systems that broker access between them. The core shift is from assuming trusted internal reachability to enforcing explicit verification, narrow authorization, and continuous monitoring at every control point. That is especially important after repeated breaches, because trust assumptions are already proven unsafe.
Carriers also need to align zero trust with the realities of telecom environments, where large flat networks, legacy platforms, and high-volume API traffic can make segmentation and identity enforcement uneven. The practical target is not to “zero trust” the whole enterprise at once, but to reduce implicit access where customer records, provisioning actions, and operational tooling intersect.
There is strong evidence that identity and secret hygiene are central to this problem. NHIMG’s Ultimate Guide to NHIs reports that 90% of IT leaders say properly managing non-human identities is essential for successful zero trust implementation, which fits carrier environments where API keys, service accounts, and automation often sit on the critical path.
For carriers, the zero trust question is therefore not only about perimeter replacement. It is about reducing the blast radius of any one stolen credential, compromised workflow, or misused integration so a breach does not become a broad customer-data event.
What carriers should change first in identity, access, and segmentation
The first control change is to stop treating internal network location as proof of trust. Customer care portals, fraud tools, billing interfaces, provisioning systems, and administrative APIs should all require explicit authentication and authorization at the transaction level, even when traffic originates from inside the carrier network.
Segmentation should follow business function, not just infrastructure topology. A compromise in one operational domain should not give direct reach into customer records, network management, or downstream partner interfaces. That means narrowing east-west connectivity, limiting service-to-service permissions, and separating sensitive customer-data stores from routine support tooling.
Mobile carriers should also pair zero trust with identity governance for non-human access, because much of the real risk sits in machine-to-machine paths. NHIMG’s 52 NHI Breaches Report and Ultimate Guide to NHIs both point to the same operational issue: if service identities are overprivileged, poorly inventoried, or not rotated, zero trust becomes a policy statement rather than a containment model.
A useful design rule is simple: if a workflow can expose customer data, change customer entitlements, or trigger downstream actions, it needs tighter verification than ordinary internal traffic. In practice, that means strong device and workload posture checks, scoped privileges, short-lived access where possible, and audit-ready logs for every sensitive action.
Risk and Threat Considerations
Repeated breaches usually indicate a control gap that attackers can reuse, not a one-off failure. In carrier environments, the most damaging pattern is often credential abuse or excessive internal privilege, because one foothold can move laterally into customer data systems, provisioning paths, or shared service infrastructure.
Failure mechanism: A compromised account, token, or API key is allowed to operate too broadly inside the carrier network, while flat connectivity or weak segmentation lets the attacker pivot from the initial entry point into higher-value systems.
Impact: Customer records, service workflows, and administrative interfaces can be exposed or altered at scale, turning a local compromise into a repeated breach pattern with regulatory, reputational, and operational consequences.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST Zero Trust (SP 800-207), CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST Zero Trust (SP 800-207) | 3.1 — Zero Trust Architecture Principles | Zero trust is the core operating model for carrier trust reduction and continuous verification. |
| 3.3 — Policy Decision and Enforcement | Carrier APIs and workflows need policy enforcement at each access decision. | |
| 3.4 — Microsegmentation | Segmentation limits lateral movement after repeated breaches in flat carrier networks. | |
| Recommendation — Apply continuous verification and least privilege across customer-data and operations paths. Enforce explicit authorization at every sensitive carrier transaction. Segment customer, support, and network-management zones to constrain lateral movement. | ||
| CIS Controls v8 | 6 — Access Control Management | Carriers need tight account and privilege control for sensitive internal and customer paths. |
| 5 — Account Management | Service and privileged accounts are a major carrier exposure point in breach scenarios. | |
| 8 — Audit Log Management | Zero trust needs evidence that sensitive actions are observable and attributable. | |
| Recommendation — Restrict and review access to customer-data and administrative systems. Inventory, review, and promptly remove stale or overprivileged accounts. Log sensitive carrier access and keep audit evidence for review and response. | ||
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication, and Access Control | Carrier zero trust depends on strong identity and access controls for users and systems. |
| PR.PT — Protective Technology | Segmentation and enforcement technologies are needed to reduce blast radius. | |
| DE.CM — Continuous Monitoring | Repeated breaches require continuous monitoring of access paths and anomalies. | |
| Recommendation — Require strong authentication and scoped authorization for sensitive carrier services. Deploy segmentation and enforcement controls that limit internal reach. Monitor customer-data access and privileged workflow activity for abuse. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | Carrier automation and APIs commonly depend on keys, tokens, and service credentials. |
| Recommendation — Rotate and vault API keys and service credentials used by carrier systems. | ||
Practitioner Guidance
What to verify: Before trusting a zero trust rollout, verify that your highest-risk customer and operations paths are actually enforced by policy, not just documented. In particular, test whether a compromised internal account can still reach billing, provisioning, or support datasets without step-up checks or explicit reauthorization.
What to prioritise: Focus first on the identities and connections that can touch customer data at scale. That usually means privileged support access, automation accounts, partner integrations, and API credentials before lower-risk user-facing segments.
What practitioners underestimate: Carriers often underestimate how much damage comes from internal trust reuse. If monitoring exists but segmentation and privilege boundaries do not, detection will explain the breach after the fact, not stop the next one.
Practitioner takeaway: Zero trust in a carrier should be measured by containment, not intent. If a single compromised identity can still traverse sensitive data and operational workflows, the architecture has not yet reduced breach impact in a meaningful way.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
