In 2021, one organisation in two declared that it had "launched its Zero Trust initiative". In 2026, according to the Forrester State of Zero Trust report, 42% of them have an incomplete architecture: identity addressed but the network not segmented, or microsegmentation deployed but MFA bypassable on machine access. This is not an acceptable state of progress. The data is clear: organisations midway through a Zero Trust programme present a more degraded exposure profile than those that have not yet started. The explanation fits in one line, and in three blind spots that this article describes.
The context: Zero Trust is not a product, it is a coherent posture
Zero Trust entered enterprise security vocabulary around the turn of the 2010s. John Kindervag's model (Forrester, 2010) and the NIST SP 800-207 publication (2020) gave a formal framework to what had until then been a diffuse intention. The principle is simple: never implicitly trust a flow, a user or a device, even inside the network perimeter. Verify explicitly, apply least privilege, assume compromise.
What happened in practice was predictable: vendors turned the principle into a product catalogue. Identity Zero Trust (MFA, SSO, ZTNA), Network Zero Trust (microsegmentation, secure SD-WAN), Device Zero Trust (EDR, MDM, posture checks), Data Zero Trust (DLP, granular encryption). Organisations bought. They deployed. Rarely in coherence.
The structural result: a hybrid architecture in which the trust assumptions of the old world coexist with the controls of the new one. And it is precisely in this coexistence that attackers find their way in.
Blind spot 1: microsegmentation without a flow inventory is blind
Microsegmentation, dividing the network into narrow zones with granular access control policies, is one of the most cited pillars of a Zero Trust architecture. It is also one of the most poorly implemented.
The problem is not technical. It is operational. In almost every microsegmentation deployment we observe on engagements, the phase of inventorying legitimate flows was not conducted sufficiently upfront. Policies were built on assumptions inherited from the historical architecture, and exceptions accumulated. In 2025, an Illumio study of 1,000 enterprise security leaders found that 67% of organisations that had deployed microsegmentation had kept undocumented exception zones representing more than 20% of their east-west traffic.
In practical terms, this means that an attacker who compromises an endpoint in a "segmented" zone can, in 67% of cases, reach at least one critical system through an unreviewed exception. Segmentation has created an illusion of control, not effective control.
The common mistake to avoid: deploying segmentation from a theoretical model without mapping the real flows observed over at least 30 days. What mature organisations do: start with an observation phase in full logging mode, then build policies from the real data.
Blind spot 2: strong identity does not cover non-human accounts
Identity is often the first workstream launched in a Zero Trust deployment, because it is the most visible and the easiest to sell: strengthened MFA, SSO, conditional access based on device posture. This is good. It is insufficient if service, application and infrastructure accounts continue to operate with static, highly privileged credentials.
The data is unambiguous. The Mandiant M-Trends 2025 survey shows that 58% of successful initial compromises pass through service or administrator account credentials. These accounts almost never benefit from MFA (technical compatibility constraints). They are not in the scope of conditional access policies. They are often documented in configurations that persist for years after their creation.
In 2025, an organisation we supported had deployed an exemplary Identity Zero Trust programme for its 2,400 human users: TOTP MFA, ZTNA for remote access, quarterly access reviews. During the audit, we identified 147 active service accounts, 38% of which held undocumented local administrator rights. One of these accounts, used by a legacy asset management application, had read access to the entire Active Directory. The Zero Trust "identity" initiative had not touched them.
The common mistake to avoid: treating the MFA perimeter as the Zero Trust perimeter for identity. Non-human accounts often outnumber human accounts by 3 to 5 times in a mid-market environment. Their inventory and governance are the workstream that reveals the real state of the programme.
Blind spot 3: documented Zero Trust and operated Zero Trust are two different organisations
The third blind spot is the one that NIS2 and DORA regulatory audits are beginning to document systematically: the gap between the Zero Trust policy approved by the executive committee (COMEX) and the operational reality of its daily application.
This gap shows up concretely. A conditional access policy states that any access from an unmanaged device is refused. In practice, an emergency exception was granted for a contractor 14 months ago and was never revoked. A microsegmentation policy forbids direct flows between the production zone and the development zone. In practice, a CI/CD pipeline has needed this access for 8 months, and the exception has no expiry date.
In March 2026, CISA published an analysis of the Zero Trust architectures of 62 US federal agencies. Conclusion: 71% had up-to-date ZT documentation, and 43% had untracked exceptions representing significant gaps between policy and actual deployment. The policy-to-reality ratio is the true indicator of maturity, not the documentary compliance score.
What distinguishes operated Zero Trust from documented Zero Trust: periodic review of exceptions (quarterly at a minimum), automatic expiry of waivers in the tools (not in documents), and the ability to answer within an hour the question "which flows are currently allowed outside the standard policy?" If answering that question requires an investigation, the programme is documented, not operated.
Assessing your real Zero Trust maturity in three questions
Before investing in an additional technology layer, ask yourself these three questions. First: can you list, in under 30 minutes, all active exceptions to your Zero Trust policies, with their justification and expiry date? Second: is your inventory of non-human identities (service, application and automation accounts) up to date and linked to your access governance programme? Third: what was the last documented east-west flow between your microsegmentation zones, and are you certain it was foreseen by your policy?
If any of these answers is "no" or "I don't know", you are in the heightened-risk configuration described in the introduction. The next useful investment is not a new tool: it is an audit of the coherence of what already exists. Valtieri supports organisations through these Zero Trust architecture diagnostics, integrated with their NIS2 and DORA compliance posture. See also: the dominant attack vectors in SMEs and the NIS2 checklist for your organisation. 30 minutes to qualify your current state.
Conclusion
Three takeaways. Microsegmentation without an inventory of real flows creates an illusion of control, not effective control: observation comes before policy. Strong identity covers only humans in most deployments; non-human accounts represent the attack surface that Zero Trust programmes have not yet reached. Finally, the gap between documented Zero Trust policy and its operational application is the true indicator of maturity: an untracked exception partly cancels the value of the architecture around it.
The organisations that come out of the Zero Trust midpoint are not those that will buy the next technology layer. They are those that will audit the gap between what they have documented and what they actually operate, and close exceptions before those become the entry route for an incident.
And in your context: if an attacker compromised an endpoint in your "most secure" zone today, how many critical systems could they reach through unreviewed exceptions? Let's talk.