Is Zero Trust Actually Failing Us?

According to Computerworld, BeyondTrust Chief Security Advisor Morey Haber recently discussed the real challenges behind zero trust adoption in an episode of Today in Tech with host Keith Shaw. Haber, who has authored several cybersecurity books, addressed everything from overhyped vendor claims to the critical role of identity management in proper zero trust implementation. The conversation covered how lateral movement prevention, emerging AI agents, and compliance frameworks like HIPAA and PCI intersect with zero trust principles. Haber argued that despite implementation struggles, the framework remains more relevant than ever in today’s security environment, particularly with AI’s growing influence on cybersecurity threats and defenses.

Sponsored content — provided for informational and promotional purposes.

<h2 id="why-zero-trust-seems-to-be-failing”>Why Zero Trust Seems to Be Failing

Here’s the thing about zero trust – everyone’s talking about it, but hardly anyone’s doing it right. The problem isn’t the concept itself, but how it’s been packaged and sold. Vendors have turned “zero trust” into this magical buzzword that supposedly solves every security problem overnight. But let’s be real – does anyone actually believe that?

I think Haber hits on something important when he points to identity as the core issue. Companies are buying zero trust products without understanding that identity is the new perimeter. You can’t just slap on some new technology and call it zero trust. The entire approach requires rethinking how you manage access, verify identities, and control lateral movement. Basically, if you’re not starting with identity, you’re doing it wrong.

The Compliance Trap

Now here’s where it gets really messy. Organizations are trying to implement zero trust to check compliance boxes for frameworks like HIPAA and PCI. But compliance doesn’t equal security – we all know that, right? Just because you’re meeting regulatory requirements doesn’t mean you’ve actually implemented proper zero trust principles.

And with AI agents entering the picture, the stakes are getting even higher. How do you apply zero trust to non-human identities that might have broad access across your systems? The traditional approaches to identity and access management just don’t cut it anymore. We’re dealing with a fundamentally different threat landscape, and our security frameworks need to evolve accordingly.

Getting Zero Trust Right

So what’s the solution? Haber’s perspective suggests we need to stop treating zero trust as a product and start treating it as a strategy. It’s about assuming breach and verifying everything – not just buying the latest shiny security tool. The framework requires continuous validation and monitoring, not one-time implementations.

The timing for getting this right has never been more critical. With AI-powered attacks becoming more sophisticated, the traditional castle-and-moat security model is completely obsolete. Zero trust isn’t failing – we’re failing to understand what it actually requires. And until we shift our mindset from product purchasing to strategic implementation, we’ll keep seeing these same implementation struggles repeat themselves.