Author: Kenith Lewis
The war for Zero Trust is over.
We won. Everyone can go home.
The marketing hype machine around Zero Trust has finally burned itself out. Every vendor promised “full Zero Trust” in a box, budgets were torched, and security teams were left with fatigue, shelfware, and the uneasy feeling that they were somehow “behind” if they hadn’t ripped out half their environment overnight. That version of Zero Trust, the buzzword, the silver bullet, the all-or-nothing transformation, is dead. And honestly, that’s a good thing. What survived is the framework. Zero Trust isn’t wrong. The way it’s been marketed is.
When Zero Trust hit the scene, it was shoved directly into leadership decks and boardrooms, often positioned as an expensive, disruptive overhaul: replace your network, replace your VPN, replace your identity stack, replace your policies…now. The intent was good, but the execution ignored reality. Most organizations simply weren’t ready to uproot years of tooling, operational processes, and risk tradeoffs, no matter how much sense the end state made. But out of the hype cycle came genuinely good concepts and products that do move the needle: continuous evaluation, VPN alternatives, stronger data-centric controls, and a more honest look at trust boundaries. Those ideas didn’t die when the hype did, they just became more strategic concepts that made sense to the enterprise.
At its core, Zero Trust has always been identity-centric. You’ve heard the phrase “identity is the new perimeter” so many times it’s practically lost meaning, but it’s still true. ~80–90% of breaches involve compromised identities*. And if there’s one takeaway worth leaving with, it’s this:
That concept applies everywhere.
Network. Data. Devices. Applications. Cloud. SaaS. On-prem. If an identity is involved, Zero Trust thinking applies. The mistake was believing you had to apply it everywhere, all at once or it’s not worth it. Progress toward Zero Trust is incremental, not revolutionary.
For example, if you’re already using Entra ID for authentication, you’re standing on solid ground. Creating Conditional Access policies that enforce MFA is table stakes, but it shouldn’t stop there. Turning on features like Continuous Access Evaluation or token protection meaningfully raises the bar. Adding risk-based Conditional Access policies that evaluate contextual sign-in data, triggering MFA challenges or forcing password resets when risk increases goes even further. We know the value of MFA reduces the risk of account compromise by over 99%*, but leveraging enhanced policies and configurations to further challenge users based on certain triggers is essentially part of the Zero Trust framework. The important part? These are often low-cost or no-cost changes. No new vendors. No massive architectural upheaval. Just smarter use of the controls you already own, compounding over time into a stronger posture.
Of course, not everything will be free or easy. Some problems do require investment and nowhere is that more apparent than identity sprawl. Modern environments are filled with non-human identities (machine identities now outnumber human identities by at least 10:1*), and we haven’t even talked about agentic AI yet. Whether their service principals, automation accounts, API tokens, AI agents, these are operating autonomously with excessive, inherited permissions. Many rely on static, long-lived credentials and exist entirely outside normal identity governance processes. When one of these identities is compromised, attackers don’t need to “hack” anything. They simply move laterally and exfiltrate data using legitimate access. Legacy tools weren’t built to detect this behavior, distinguish between normal and malicious autonomous activity, or continuously evaluate trust once access has been granted.
This is Zero Trust’s next uncomfortable frontier.
It’s also why Zero Trust can feel overwhelming. It doesn’t live in one product, one policy, or one team. It stretches across the entire environment, from human users to machine identities to AI-driven workflows that never sleep. But that doesn’t mean it’s unattainable. The goal isn’t perfection. The goal is momentum. Chip away. Make small, defensible improvements. Reduce standing privilege. Add context where none existed before. Re-evaluate trust continuously instead of assuming it indefinitely. Over time, those incremental changes add up to something real.
So yes, Zero Trust, as a marketing slogan, is dead. The framework is very much alive.
From Insight to Execution
This article introduces the concept. We’ve developed a full whitepaper that provides step-by-step guidance on how to operationalize Zero Trust using tools you already own.
Access the complete whitepaper here.
* Article Sources: