Zero Trust: 4 Half-Truths to Avoid and Next Steps

This piece was reviewed by Teresa Wu, Vice President, Smart Credentials & Smart Integrate at IDEMIA Public Security.

Zero Trust sounds like a buzzword. The phrase appears in vendor presentations, white papers and webinars, often with very different meanings. Behind the noise sit a few half-truths that are not wrong, just half right. The half-truth is much harder to argue with in a meeting, harder to assess honestly, and harder to correct before an incident happens. Here are the four that come up most, each with a real incident attached, followed by a practical checklist for your own organization.

Rethinking Zero Trust: 4 Half-Truths

Half-Truth 1: “Zero Trust means trusting no one”

WHAT HAPPENED

In May 2021, attackers entered Colonial Pipeline through a single VPN password on a dormant account with no multi-factor authentication (Turton & Mehrotra, 2021; Blount, 2021). The company paid a ransom of about 4.4 million dollars, of which roughly 2.3 million was later recovered by the US Department of Justice, and the largest US fuel pipeline stopped for six days. The incident illustrates the risk created by legacy access that remains available without adequate authentication controls: access granted once and not re-examined afterwards.

THE FULL PICTURE

Zero Trust does not remove trust from everyone. It gives trust an expiry date. The highest maturity stage for the Authentication function is identity validated continuously, not identity never validated (CISA, 2023, Table 2, p. 13). The opposite of Colonial is not a stronger password. It is an access decision that gets made again.

Half-Truth 2: “Zero Trust is a product you can buy”

WHAT HAPPENED

“We bought ZTNA/microseg. We have finished Zero Trust” is a common misunderstanding.

Google’s published account of BeyondCorp describes moving access decisions away from any reliance on a privileged internal network and onto user and device information, enforced by an access control engine, with applications migrating into phases over several years (Ward & Beyer, 2014). That is a change to architecture and operations as much as technology, not a single product.

THE FULL PICTURE

Products support Zero Trust, but the policies and the day-to-day operations still have to be built. John Kindervag, who created the term in 2010 and is often called the godfather of Zero Trust, puts it plainly: Zero Trust is a strategy, and you cannot buy it (Kindervag & Farnum, 2024). CISA says the same about its own model, describing it as one of many paths (CISA, 2023, p. 7) and a general guide rather than a strict set of requirements (p. 12). NIST adds that there is no single architecture that fits every organization (NCCoE, 2025, p. 5).

Half-Truth 3: “We have multi-factor authentication, so we are doing Zero Trust”

WHAT HAPPENED

In September 2022, an attacker likely purchased an Uber contractor’s corporate password on the dark web, most likely after malware exposed it, then triggered login attempt after login attempt until the contractor’s phone filled with approval prompts. Each time the contractor received a two-factor approval request, which initially blocked access. Eventually the contractor accepted one, and the attacker logged in. From there, according to Uber’s own account, the attacker reached several other employee accounts and gained elevated permissions to a number of tools (Uber, 2022). The multi-factor authentication was never broken. It was used.

THE FULL PICTURE

Having multi-factor authentication is one thing. How it holds up under attack is another. On CISA’s scale, multi-factor authentication that may still include a password sits at the Initial stage, second of four. Phishing-resistant, passwordless authentication using FIDO2 or PIV is only Advanced. Continuous validation is Optimal (CISA, 2023, Table 2, p. 13). Treating multi-factor authentication as the finish line can overstate an organization’s maturity by two stages.

Moving up that column is a procurement decision as much as a policy one. IDEMIA Public Security’s ID Key Bolt sits in the Advanced description: a single USB security key carrying both FIDO2 and PIV applets, which lets an organization adopt phishing-resistant, passwordless authentication without setting aside an existing PKI investment. Push-approval prompts are not part of a FIDO2 flow at all, which is why phishing-resistant methods are not exposed to the technique used against Uber.

Half-Truth 4: “If we still get breached, Zero Trust doesn’t work”

WHAT HAPPENED

In June 2017, NotPetya reached Maersk through a compromised software update. The malware spread on its own, and nothing inside the network slowed it down. Maersk rebuilt 4,000 servers, 45,000 PCs and 2,500 applications in ten days, and estimated the damage at 250 to 300 million dollars (Snabe, 2018).

THE FULL PICTURE

A breach does not prove Zero Trust failed. Uncontained access does. Zero Trust starts from the assumption of compromise. NIST defines it as making access decisions with the network viewed as already compromised (NIST, 2020). The purpose is to limit how far an intruder moves and how long they stay, not to guarantee that nobody gets in.

So, measure containment, not incident count. Two numbers work: the share of privileged sessions using just-in-time access, which is CISA’s Optimal stage for access management (CISA, 2023, Table 2, p. 14), and the age of your oldest unrotated credential

So, what is Zero Trust and how does the maturity model help?

Start with the definition. NIST describes Zero Trust as a way to reduce uncertainty by enforcing accurate, least privilege, per request access decisions, with the network treated as already compromised (NIST, 2020). Per request is the part that matters.

Zero Trust – The Five Pillars of CISA Maturity Model

CISA turned that into a grid. Five pillars, three capabilities running underneath all of them, and four maturity stages that each pillar climbs at its own pace (CISA, 2023, pp. 6–9).

Running underneath all five: Visibility and Analytics, Automation and Orchestration, and Governance. The four stages are Traditional, Initial, Advanced, and Optimal.

One point to be clear about: this model was written for United States federal agencies, so treat it as a reference point rather than a global rulebook. It is still the clearest public description of what maturity looks like, which is why it is worth scoring yourself against.

Score yourself: the identity pillar in four rows

Print this. Mark one box per row, honestly, and write the date on it to assess your Zero Trust maturity.

Most organizations land on Traditional or Initial stage in at least two rows. That is not a failure but the starting position to implement Zero Trust now.

Where identity sits and how IDEMIA Public Security fits

Identity is one of the five Zero Trust pillars. Checking the device does not tell you who is using it. A laptop may meet security requirements while the person requesting access is an impostor. This is where IDEMIA Public Security contributes: helping organizations verify the person behind an access request.

In November 2025, IDEMIA Public Security was announced as a launch partner for Microsoft Entra Verified ID as the service moved into general availability, covering employee onboarding, password and account recovery, contact Centre communications and help-desk support (IDEMIA Public Security, 2025). In that flow, IDEMIA Public Security performs the identity proofing step, using document verification and liveness detection. Microsoft Entra then checks the verified identity against the account, according to the organization’s configured rules, before allowing the user to register new sign-in methods. The useful part is separation. Verifying who a person is and confirming that person’s right to recover a particular account are two different questions. Answering the first one with biometric identity proofing can help reduce how much a help-desk agent has to judge from a phone call alone.

What organizations can do

1. Find every access that was granted once and never re-decided. Dormant accounts, standing VPN access, long single sign-on windows, a badge valid until midnight. Rank them by what an attacker reaches if they win it.

2. Write down which pillar and which stage each Zero Trust purchase covers. Five pillars, four stages, in CISA’s own words.

3. Score your authentication row and date it. If multi-factor still includes a password, the honest answer is Initial. Move privileged accounts to phishing-resistant first: smallest population, largest blast radius.

4. Audit the six moments where a credential is issued or restored. New joiner, device replacement, service desk recovery, lost credential, privileged account issuance, high-risk account change. Compare the proof required at each one. The gap between the first and the third is usually the finding.

5. Re-score in six months and compare the dates. The delta is the program. The label was never the point.

And one question for any supplier

“When the risk score changes in the middle of a session, what exactly do you re-verify: the person, the device, or only the token?”

One trusted identity. Secure access everywhere.

SOURCES:
Blount, J. A., Jr. (2021, June 8). Testimony before the U.S. Senate Committee on Homeland Security and Governmental Affairs: Threats to critical infrastructure – Examining the Colonial Pipeline cyber attack. https://www.hsgac.senate.gov/wp-content/uploads/imo/media/doc/Testimony-Blount-2021-06-08.pdf
Cybersecurity and Infrastructure Security Agency. (2023). Zero trust maturity model (Version 2.0). U.S. Department of Homeland Security. https://www.cisa.gov/sites/default/files/2023-04/zero_trust_maturity_model_v2_508.pdf
IDEMIA Public Security. (2025, November 20). IDEMIA Public Security expands collaboration with Microsoft as a launch partner of Microsoft Entra Verified ID. https://na.idemia.com/2025/11/20/idemia-public-security-expands-collaboration-with-microsoft-as-a-launch-partner-of-microsoft-entra-verified-id/
Kindervag, J., & Farnum, M. (2024, July 31). 5 zero trust myths busted. Illumio. https://www.illumio.com/blog/5-zero-trust-myths-busted-by-john-kindervag-and-michael-farnum
National Cybersecurity Center of Excellence. (2025). Implementing a zero-trust architecture (NIST Special Publication 1800-35). National Institute of Standards and Technology. https://www.nccoe.nist.gov/projects/implementing-zero-trust-architecture
National Institute of Standards and Technology. (2020). Zero trust architecture (NIST Special Publication 800-207). https://doi.org/10.6028/NIST.SP.800-207
Snabe, J. H. (2018, January 24). Remarks during “Securing a common future in cyberspace” [Panel]. World Economic Forum Annual Meeting, Davos, Switzerland. https://www.weforum.org/videos/securing-a-common-future-in-cyberspace-3e0cd313d2
Turton, W., & Mehrotra, K. (2021, June 4). Hackers breached Colonial Pipeline using compromised password. Bloomberg. https://www.bloomberg.com/news/articles/2021-06-04/hackers-breached-colonial-pipeline-using-compromised-password
Uber. (2022, September 19). Security update. Uber Newsroom. https://www.uber.com/us/en/newsroom/security-update/
Ward, R., & Beyer, B. (2014). BeyondCorp: A new approach to enterprise security. ;login: 39(6), 6–11. https://www.usenix.org/publications/login/dec14