Zero trust adoption figures range from "fewer than 1% mature" to "81% implemented", and most of that gap comes from what each survey counts as adoption rather than from real differences between organisations. This page collects zero trust adoption statistics from the publishers' own pages, or from two agreeing news reports where the publisher's page could not be read: Gartner, Okta, Zscaler ThreatLabz, StrongDM, Keeper Security, Cisco, the US Office of Management and Budget and the US Department of Defense. Every figure carries the publisher, report and year in the same sentence or table row, and the methodology table says which numbers come from a single vendor survey. It is written for security leaders, architects and programme managers who need a defensible baseline for a zero trust business case or board report, and who want to know which numbers to avoid quoting. Last reviewed: November 2026.
Key takeaways
- Most organisations say they have started. Gartner's survey of 303 security leaders, released in April 2024, found 63% had fully or partially implemented a zero trust strategy, and Okta's State of Zero Trust Security 2023 put the figure at 61% of more than 800 decision-makers.
- Very few are mature. Gartner predicted in January 2023 that only 10% of large enterprises would have a mature and measurable zero trust programme by 2026, up from less than 1% at the time, and Cisco's 2025 Cybersecurity Readiness Index found only 4% of 8,000 organisations at its Mature level.
- Coverage is partial. Gartner's John Watts said in 2024 that a zero trust strategy typically addresses half or less of an organisation's environment and mitigates a quarter or less of enterprise risk.
- Government deadlines are concrete and slipping. OMB M-22-09 set the end of fiscal year 2024 for federal civilian agencies, and DoD News reported in February 2025 that 14% of target-level activities were complete across 58 DoD components, against a fiscal year 2027 target.
- Remote access is the most common starting point. Zscaler ThreatLabz's 2025 VPN Risk Report found 65% of more than 600 respondents planned to replace VPN services within the year, a single-vendor survey that matches the access-first pattern in federal and DoD plans.
Headline statistics
The table gives the zero trust adoption figures most often requested, each with the latest edition we could read in November 2026. "Implemented" means "fully or partially implemented" unless stated, which is the main reason headline figures look high.
| Statistic | Figure | Source, publisher and year |
|---|---|---|
| Organisations with a zero trust strategy fully or partially implemented | 63% (303 security leaders, survey Q4 2023) | Gartner survey, released April 2024, as reported by Cybersecurity Dive and Dark Reading |
| Organisations that have implemented zero trust strategic initiatives | 61%, with 35% planning to soon (800+ decision-makers) | The State of Zero Trust Security 2023, Okta |
| Large enterprises with a mature, measurable zero trust programme | Less than 1% in 2023; 10% predicted by 2026 | Gartner prediction, January 2023 |
| Organisations at the Mature cybersecurity readiness level | 4% (8,000 leaders, 30 markets), up from 3% | 2025 Cisco Cybersecurity Readiness Index, Cisco |
| Organisations fully or partially implementing a zero trust model | 81% (600 US professionals, November 2024) | StrongDM survey via Pollfish, January 2025 |
| Organisations that say they have effectively implemented zero trust | 27.3% (110 respondents at Black Hat 2025) | Keeper Security, August 2025, as reported by SC Media |
| Organisations planning to implement zero trust in the next 12 months | 81% (600+ IT and security professionals) | ThreatLabz 2025 VPN Risk Report, Zscaler with Cybersecurity Insiders |
| DoD target-level zero trust activities completed | 14% across 58 components (February 2025) | DoD News, 26 February 2025, citing the Zero Trust Portfolio Management Office |
| Zero trust budgets increased year on year | 80% of respondents; 20% by 25% or more | The State of Zero Trust Security 2023, Okta |
Statistics by theme
How many organisations have started
- Gartner 2024: 63% of organisations worldwide had fully or partially implemented a zero trust strategy, from a survey conducted in the fourth quarter of 2023 and released on 22 April 2024. Dark Reading reports that 56% of adopters did so because zero trust is considered an industry best practice, and that 35% reported failures that interrupted their implementation.
- Okta 2023: 61% of more than 800 information security decision-makers said they had implemented zero trust strategic initiatives, and 35% planned to do so soon. The headline "96% favour zero trust" on Okta's blog is not defined in the text, so we do not quote it.
- StrongDM 2025: 81% of 600 US-based cybersecurity professionals, surveyed through Pollfish in November 2024, said their organisation had fully or partially implemented a zero trust model; 19% were still planning.
- Keeper Security 2025: only 27.3% of 110 professionals interviewed at Black Hat 2025 said their organisation had effectively implemented zero trust. The small, conference-based sample makes this an indicator, not a benchmark.
Maturity and depth
Adoption counts and maturity measures answer different questions. The table sets them side by side.
| Measure | Figure | Source and year | What it counts |
|---|---|---|---|
| Started (fully or partially) | 63% | Gartner, 2024 | Any implemented strategy, any scope |
| Environment covered by a typical strategy | Half or less | Gartner (John Watts), 2024 | Analyst view of scope |
| Enterprise risk mitigated by a typical strategy | A quarter or less | Gartner (John Watts), 2024 | Analyst view of risk coverage |
| Adopters with strategic metrics | 4 in 5; 9 in 10 of those measure risk | Gartner, 2024 | Programme governance |
| Mature and measurable programmes in large enterprises | Under 1% (2023), 10% predicted for 2026 | Gartner, January 2023 | Analyst prediction, not a survey result |
| Mature overall security readiness | 4% | Cisco Cybersecurity Readiness Index, 2025 | 31 capabilities across five pillars, including identity and network |
Gartner's January 2023 release also predicted that, through 2026, more than half of cyberattacks would target areas that zero trust controls do not cover. Gartner's 2026 prediction is due to be tested this year; we have not found a published Gartner follow-up that measures it.
Budgets, costs and technology
- Budgets: 80% of respondents in Okta's 2023 report said zero trust budgets increased year on year, and 20% raised spending by 25% or more.
- Expected costs: in Gartner's 2024 survey, 3 in 5 organisations expected costs to rise and 2 in 5 expected staffing requirements to increase as a result of zero trust.
- Technology mix: Gartner reported that about half of zero trust strategies combine existing and new technologies, about 30% use only existing technologies and about 20% involve new technology alone.
- Barriers: StrongDM's 2025 survey found 48% cited cost and resource constraints and 22% internal resistance; Keeper's 2025 sample gave 30% for deployment complexity and 20% for lack of leadership support.
- Tool sprawl: 77% of respondents in the 2025 Cisco index said complex infrastructures of more than ten point solutions impede response, which is the consolidation argument many zero trust programmes make.
Identity as the core pillar
- Identity priority: the share of Okta's 2023 respondents rating identity "extremely important" to their zero trust strategy rose from 27% to 51% globally, and reached 64% in North America.
- Priority areas: 67% of StrongDM's 2025 respondents named identity and access management and data encryption as top priorities, and 57% reported minimal or no strict controls for database and data access.
- Federal identity goal: M-22-09 requires agency staff to use enterprise-managed accounts protected by phishing-resistant MFA. See the Zero Trust Identity Guide.
Remote access and VPN replacement
- Replacement plans: 65% of respondents to the Zscaler ThreatLabz 2025 VPN Risk Report planned to replace VPN services within the year, and 81% planned to implement zero trust strategies within 12 months. Zscaler sells zero trust access, so treat these as directional.
- VPN vulnerabilities: ThreatLabz's analysis of the MITRE CVE Program found VPN CVEs grew by 82.5% between 2020 and 2025, with roughly 60% of the past year's VPN vulnerabilities rated high or critical.
- Unmanaged devices: 84% of respondents to the 2025 Cisco index said employees accessing networks from unmanaged devices increased their risk.
The Cisco breach of 2022 shows why access-first programmes matter: a synced browser password and MFA fatigue gave the attacker VPN access to the corporate network. See the ZTNA Guide.
Public sector programmes
| Programme | Deadline or status | Source |
|---|---|---|
| US Executive Order 14028 | May 2021; directed federal movement towards zero trust architecture | zerotrust.cyber.gov (Federal Zero Trust Strategy) |
| OMB M-22-09 Federal Zero Trust Strategy | Issued 26 January 2022; specific goals by end of fiscal year 2024 | OMB M-22-09; zerotrust.cyber.gov |
| DoD Zero Trust Strategy and Roadmap | Released November 2022; target level by fiscal year 2027; 45 capabilities and more than 100 activities | DoD CIO |
| DoD progress | 14% of target-level activities complete across 58 components; 91 of 152 target activities expected by FY2027 | DoD News, 26 February 2025 |
| Federal civilian measurement | FY23 FISMA report: 76 agencies met 80% EDR coverage of known endpoints; no phishing-resistant MFA percentage published | FY 2023 FISMA Annual Report to Congress, OMB |
The M-22-09 goals are organised by the CISA pillars: identity (phishing-resistant MFA), devices (complete inventory and endpoint detection), networks (encrypted DNS and HTTP, isolated environments), applications (treat every application as internet-accessible) and data (categorisation, monitoring and enterprise logging). We have not found an official count of agencies that met every goal by the end of fiscal year 2024, so we do not quote one. See the DoD Zero Trust Strategy and Reference Architecture Guide and the CISA Zero Trust Maturity Model Guide.
What the numbers mean for defenders
The statistics agree that zero trust is now a mainstream intention and a minority achievement. A board that hears "63% have implemented zero trust" should also hear Gartner's own caveat that a typical strategy covers half or less of the environment. The mapping below links each finding to the controls that close it.
| Finding | Control that answers it | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | MITRE ATT&CK |
|---|---|---|---|---|
| Identity rated the leading pillar (Okta 2023) | Phishing-resistant MFA, conditional access, least privilege | IA-2, AC-6 | PR.AA-01, PR.AA-05 | T1078 Valid Accounts |
| VPN replacement planned by 65% (Zscaler 2025) | Per-application access, no network-level trust | AC-17, SC-7 | PR.IR-01 | T1133 External Remote Services |
| VPN CVEs up 82.5% (ThreatLabz 2025) | Reduce exposed appliances, patch edge devices first | CM-7, SC-7 | PR.PS-01 | T1190 Exploit Public-Facing Application |
| Strategies cover half or less of the environment (Gartner 2024) | Asset and workload inventory, segmentation | AC-4, CA-7 | ID.AM-02 | Not technique-specific |
| 57% lack strict data access controls (StrongDM 2025) | Data-centric policy enforcement and monitoring | AC-3, SI-4 | DE.CM-01 | T1078.004 Cloud Accounts |
In CIS Controls v8.1 the same ground sits under Control 5 (Account Management), Control 6 (Access Control Management), Control 12 (Network Infrastructure Management) and Control 13 (Network Monitoring and Defense). In ISO/IEC 27001:2022 Annex A, look at A.5.15 Access control, A.8.20 Networks security and A.8.22 Segregation of networks.
Turning the statistics into a programme
- Baseline with the CISA Zero Trust Maturity Model: score each of the five pillars (identity, devices, networks, applications and workloads, data) at Traditional, Initial, Advanced or Optimal, so your own figure replaces the survey averages.
- Start with identity and remote access: enforce phishing-resistant MFA for administrators and remote users, then move the highest-risk applications from VPN to per-application access in pilot groups.
- Run in monitor mode first: put conditional access and segmentation rules in report-only or alert mode for two to four weeks, review what would have been blocked, then enforce.
- Keep a rollback path: retain the VPN for a defined fallback group until per-application access has run cleanly for a full business cycle, and document break-glass accounts.
- Extend to workloads and non-human identities: service accounts, API keys and workload identities need the same verification. See the Zero Trust for AI Agents Guide.
- Report coverage, not intent: publish the share of applications, users and workloads under zero trust policy each quarter.
Small and large organisations
Gartner's prediction concerned large enterprises, where legacy applications and flat networks slow progress. A small organisation that already runs on SaaS and a cloud identity provider can often reach the identity and device goals with conditional access and managed devices alone. A large one should expect a multi-year programme, sponsored by the CIO or board as Gartner observed, with segmentation and application migration as the long poles.
Metrics worth tracking
- Application coverage: percentage of internal applications reachable only through per-application access.
- Phishing-resistant MFA coverage: share of all users and of privileged users on FIDO2, passkeys or smart cards.
- Device posture: share of sessions from managed, compliant devices.
- Segmentation: share of critical workloads in isolated segments with default-deny rules.
- Maturity score: CISA ZTMM stage per pillar, reviewed every six months.
Common failure patterns when using zero trust statistics
- Treating "partially implemented" as done: Gartner's 63% and StrongDM's 81% both include partial programmes. Neither says the organisation has removed implicit trust.
- Quoting predictions as results: Gartner's "10% mature by 2026" is a forecast made in 2023, not a measured share.
- Using vendor surveys without the sponsor: Zscaler, Okta, StrongDM and Keeper sell products in this market. Name the sponsor every time.
- Ignoring non-human identities: surveys ask about users and networks. Integrations with long-lived tokens bypass user-centric controls, as the Salesloft Drift breach showed in 2025. See the Top 10 Zero Trust Mistakes.
- Counting deadlines as outcomes: OMB and DoD dates are targets. DoD's own February 2025 figure was 14% of target-level activities complete.
Methodology notes and caveats
| Source | What it measures | Sample and period | Caveat |
|---|---|---|---|
| Gartner survey (April 2024) | Strategy adoption, metrics, costs | 303 security leaders, Q4 2023 | Gartner release not readable to us; figures from two news reports |
| Gartner prediction (January 2023) | Forecast of mature programmes | Analyst prediction | Not a survey result |
| Okta State of Zero Trust Security 2023 | Initiatives, budgets, pillar priorities | 800+ decision-makers, dates not stated | Single vendor survey; latest edition we found |
| Zscaler ThreatLabz 2025 VPN Risk Report | VPN replacement and zero trust plans | 600+ professionals with Cybersecurity Insiders | Single vendor survey; sponsor sells zero trust access |
| StrongDM (January 2025) | Adoption, barriers, priorities | 600 US professionals, November 2024 | Single vendor survey; online panel |
| Keeper Security (August 2025) | Effective implementation | 110 people at Black Hat 2025 | Small conference sample |
| Cisco Cybersecurity Readiness Index 2025 | Overall readiness across five pillars | 8,000 leaders in 30 markets | Broader than zero trust; no pillar figures published |
| DoD News (February 2025) | DoD target-level activities | 58 components | Point-in-time; read via a republished copy |
Practitioner checklist
- Quote "fully or partially implemented" in full whenever you use Gartner, Okta or StrongDM adoption figures.
- Pair any adoption figure with a maturity figure (Gartner 2023 prediction or Cisco 2025 index).
- Name the sponsor and sample size for every vendor survey.
- Score your own programme against the CISA Zero Trust Maturity Model pillars and report it next to the survey figures.
- Measure application coverage and phishing-resistant MFA coverage, not programme intent.
- Include service accounts, API keys, OAuth integrations and AI agents in zero trust scope.
- Track public sector deadlines (FY2024 civilian, FY2027 DoD) as targets, not achievements.
- Review this page's sources each year; Okta's and Gartner's latest readable editions are now two to three years old.
Standards and references
- NIST: SP 800-207 Zero Trust Architecture
- CISA: Zero Trust Maturity Model
- Office of Management and Budget: M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles
- Federal Zero Trust Strategy (zerotrust.cyber.gov)
- DoD CIO: DOD Releases Path to Cyber Security Through Zero Trust Architecture
- Gartner: Predicts 10% of Large Enterprises Will Have a Mature and Measurable Zero-Trust Program by 2026
- Cisco: 2025 Cybersecurity Readiness Index announcement
- Zscaler ThreatLabz: 2025 VPN Risk Report findings
Related NHI Mgmt Group resources: NIST SP 800-207 Zero Trust Architecture Guide · Zero Trust Executive Briefing · MFA Adoption Statistics · Identity Attack Statistics Guide · SaaS Security Statistics.