What Nobody Tells You About Zero Trust
Zero Trust is the most consequential security architectural shift of the last decade. It's also, in most enterprise implementations, exactly as effective as the identity posture it was layered on top of, which is to say: not very. I don't say this as a critic of the model. I say it as someone who has watched the pattern play out enough times to recognize its shape. Zero Trust initiative starts. …
- Most organizations implement Zero Trust in the order that's most visible to leadership, not the order that most reduces risk, network first, identity never.
- Continuous verification is structurally invalidated by credential persistence. A 24-hour session token isn't continuously verified; it's verified once.
- Device posture theater happens when MDM enrollment status is the only signal being evaluated, that checks registration, not current device behavior.
- Policy coverage and enforcement coverage are not the same thing. Most organizations can't answer whether their policies are evaluating real access decisions.
- Real Zero Trust is a question, not a scorecard: for this specific access attempt, what is the enforcement chain, and what does a failure look like in our logs?
The Network Pillar Trap
The CISA Zero Trust Maturity Model describes five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. They're listed in that order deliberately, identity is foundational, data is the endpoint, networks are the middle. Most enterprise implementations work through them in reverse order. Networks are where Zero Trust programs start because networks are where security teams live. Firewall rules, microsegmentation, east-west traffic controls, ZTNA replacing VPN, these are con
Credential Persistence Breaks The Model
"Continuous verification" is the promise. The delivery: a 24-hour session token, issued at login, reused until expiry, never re-evaluated in between. This is Zero Trust's most common implementation gap, and it's structural. Most identity systems implement authentication at session start, not at each resource access. The user authenticates, gets a token, and that token is trusted implicitly for hours, sometimes days. In enterprise SSO environments with long-lived SAML assertions, "continuously v
Device Posture Theater
The device pillar asks: is the device making this request in a state I trust? In theory: endpoint detection running, OS patched, MDM-enrolled, disk encrypted, no known indicators of compromise. In practice: MDM-enrolled. MDM enrollment is a registration event. It tells you the device was provisioned and configured to an acceptable baseline at enrollment time. It tells you nothing about the device's current state. An MDM-enrolled laptop that hasn't synced a policy update in six weeks, is running
Frequently asked questions
- How do you tell whether your Zero Trust implementation is operational or theater?
- Run the enforcement coverage test: pick five access attempts from the last week that should have triggered a policy evaluation, then verify each one actually did, and that a violation would have been logged. If you can't answer that for five real attempts, your enforcement coverage is unknown. Next, audit credential expiry. If your ten most sensit…
- What's the minimum viable Zero Trust implementation for a 50-person engineering team?
- Three things, in order. First: short-lived credentials for CI/CD via OIDC federation with your cloud provider, this removes the most common persistent credential class in small engineering environments. Second: MFA enforced for all human access with conditional access policies that actually deny when conditions fail, not just log. Third: a service…
- How does Zero Trust intersect with secrets management, are they the same program?
- Related but distinct. Secrets management is about where sensitive values live and how they're delivered to workloads, Vault, AWS Secrets Manager, environment isolation. Zero Trust is about whether every access attempt is verified against policy before being granted. They interact heavily: good secrets management eliminates the long-lived static cr…
- If you've already built the network pillar, where do you go next?
- Identity, specifically, service account audit and workload identity federation. These two investments have the highest risk-reduction-per-hour of any Zero Trust work after network segmentation. Service account audit reveals the persistent credentials that network controls don't address. Workload identity federation (AWS OIDC, Kubernetes projected …
- What does continuous verification actually look like at the token and session level?
- At the session level: tokens with short lifetimes re-issued via a refresh flow that re-evaluates conditional access policy on each refresh, not just at initial authentication. A policy change takes effect within one token lifetime, not whenever the user next logs in. At the workload level: projected Kubernetes service account tokens with audience …