Why Zero Trust Programmes Stall at Identity

PRAECEPTA CS

Sep 2

10 min read

Updated: Sep 4

A PRAECEPTA Cybersecurity Position Paper

Series: The Architecture of Trust

Executive Summary

Zero Trust is not failing. It is stalling — and it stalls in a consistent, predictable place.

Across the engagements PRAECEPTA reviews in the Gulf, wider Middle East, and Africa, the pattern repeats with near-mechanical reliability. Programmes launch with executive sponsorship and a network-centric work package. Micro-segmentation proceeds. ZTNA replaces VPN. Device posture tooling is procured. Then, somewhere between month nine and month eighteen, velocity collapses. The programme does not fail loudly; it enters an indefinite "Phase 2" that never begins.

The proximate cause is almost always identity. The root cause is more interesting, and it is not a technology problem.

PRAECEPTA's thesis: Zero Trust requires identity to function as a real-time control plane. In most organisations, identity is architected as a periodic administrative process. These two things operate on incompatible clock speeds. Zero Trust programmes do not stall because identity is difficult — they stall because the programme discovers, too late, that its policy engine is asking questions its identity estate was never designed to answer, at a tempo it was never designed to sustain.

We call this the Identity Impedance Mismatch. This paper defines it, decomposes it into six recurring stall points, identifies four accelerants specific to the MEA operating context, and sets out a sequencing model — the Trust Spine — that avoids the stall rather than remediating it.

Supporting evidence is strong on the threat side and directionally strong on the maturity side. Where the evidence base is thin, we say so.

1. The Evidence: Identity Is Both the Dependency and the Target

Three data points frame the problem.

Signal	Finding	Implication for ZTA
Execution gap	In 2025–26 industry survey data, only ~17% of organisations report full deployment of universal ZTNA, against ~46% partial and ~24% planning — an execution gap of roughly 65 points between intent and operational reality — vendor-sponsored survey	Partial deployment is the norm, not the exception. Something systemic is arresting progression.
Attacker preference	Verizon DBIR 2025 placed credential abuse as the leading initial access vector at 22% of analysed breaches. DBIR 2026 reporting indicates vulnerability exploitation has overtaken credential theft as the top vector	The re-ordering does not weaken the identity case. Exploitation gains access; identity abuse converts access into impact. Lateral movement, persistence, and privilege escalation remain identity-mediated.
Estate composition	Non-human identities now outnumber human identities at ratios reported around 144:1 in cloud-native environments (up from ~92:1 in H1 2024); ~82 machine identities per employee as a global benchmark; 89% of organisations report ratios of at least 25:1 — vendor telemetry, methodology varies	The overwhelming majority of the identity estate has no HR record, no joiner-mover-leaver process, and frequently no named owner.

NIST SP 800-207 is explicit that the Policy Engine is dependent on external inputs — identity provider assertions, device posture, threat intelligence, and contextual signals. SP 800-207 further notes that service identity assignment is domain-specific, complicating consistent policy deployment across on-premises, cloud, and heterogeneous runtimes.

The standard, in other words, told us where the difficulty would be. Most programme plans did not read it that way.

2. The Identity Impedance Mismatch

The core insight is one of tempo, not capability.

A Zero Trust Policy Decision Point must resolve, per access request, in milliseconds: who or what is this, what is its current trust state, and is this entitlement still valid right now?

Enterprise identity governance was designed to answer a materially different question on a materially different cadence: was this entitlement approved by someone with authority at some point in the past, and has it been recertified within the last audit cycle?

Function	Native tempo of identity estate	Tempo demanded by ZTA	Impedance
Access provisioning	Days (ticket-driven)	Minutes (just-in-time)	High
Entitlement recertification	Quarterly / semi-annual	Continuous	Severe
Deprovisioning on termination	Days to weeks (HR-triggered)	Seconds to minutes	Severe
Privilege elevation	Standing, persistent	Ephemeral, session-scoped	High
Device posture signal	Daily scan, or on-connect	Sub-5-minute freshness	High
Non-human credential rotation	Annual, or never	24h – 90d, automated	Severe
Trust revocation on compromise signal	Manual, analyst-initiated	Automated, sub-minute	Severe

Where impedance is severe, the policy engine has three options, all bad: decide on stale data (security theatre), fail open (defeating the model), or fail closed (breaking the business, generating false denials, and triggering the political backlash that stalls the programme).

SP 800-207 anticipates a tuning phase in which legitimate requests are denied due to misconfiguration. In practice, in MEA enterprises with high manual-process dependency, that tuning phase is where programmes die — not because the tuning is impossible, but because the first significant business disruption converts the CISO's mandate from transformation to restoration of service.

The stall is a tempo failure that presents as a technology failure and is misdiagnosed as a tooling gap. The subsequent procurement cycle — buying another identity product — does not resolve it.

3. The Six Stall Points

3.1 No Authoritative Source of Identity Truth

Zero Trust presumes a resolvable subject. Most enterprises cannot state, with evidence, how many distinct human identities they have. HR systems, Active Directory, cloud IdPs, contractor registers, OT engineering workstations, and SaaS-local accounts each hold partial, conflicting, and duplicated records.

Identity resolution — collapsing multiple records to one accountable entity — is unglamorous, slow, and politically fraught because it exposes the fact that no single function owns the answer. It is also non-optional. You cannot enforce policy against an entity you cannot uniquely name.

3.2 Entitlement Debt

We propose entitlement debt as a first-class architectural concept, directly analogous to technical debt: the accumulated gap between entitlements granted and entitlements exercised.

Every historical role change, project, secondment, and emergency access grant that was never revoked compounds this debt. Zero Trust's least-privilege requirement demands that debt be settled. Organisations routinely discover that 60–90% of granted entitlements are unexercised over any 90-day window, and that no one has authority to remove them because no one can prove they are unnecessary.

The programme then confronts an unpalatable choice: a multi-year entitlement remediation exercise with no visible security outcome for eighteen months, or enforcement of a least-privilege model over a corrupt baseline — which is not least privilege at all. Most choose a third option: defer. That deferral is the stall.

3.3 Signal Staleness at the Decision Point

The Policy Engine is only as good as its freshest input. Where device posture is refreshed daily, threat context arrives by email, and identity risk scoring is computed hourly, "continuous verification" is a marketing term applied to periodic verification.

This is the single most common gap PRAECEPTA identifies in ZTA design reviews: elegant enforcement architecture fed by signals with latency measured in hours.

3.4 Non-Human Identity Blindness

At 144:1 ratios, the human identity programme addresses under 1% of the estate. Service accounts, API keys, workload identities, CI/CD tokens, and — increasingly — agentic AI identities constitute the actual attack surface. Reporting suggests a substantial majority of identity-related breaches now involve NHIs.

NHIs typically have: no lifecycle owner, standing rather than ephemeral privilege, credentials embedded in code or configuration, no MFA, no behavioural baseline, and no deprovisioning trigger. The CSA's 2026 work on non-human identity and agentic AI governance is the most useful current reference frame here.

Agentic AI materially worsens this. An autonomous agent acting on delegated human authority breaks the assumption that an identity maps to a single accountable subject with stable intent. Current IdP and IGA products do not model delegation chains, intent scoping, or revocation propagation across agent hierarchies. PRAECEPTA's assessment is that this becomes the dominant identity architecture problem within 24 months, and organisations should not design their identity control plane as though it were a workforce-only problem.

3.5 The Legacy and OT Identity Floor

A Policy Enforcement Point cannot enforce identity context that the protocol cannot carry. Modbus, DNP3, PROFINET, and much legacy middleware have no identity primitive. Shared operator consoles in control rooms are an operational safety design choice, not a lapse.

In MEA energy, utilities, and heavy industry — a disproportionate share of the region's critical national infrastructure — this is a hard architectural floor. IEC 62443 zone-and-conduit segmentation with brokered, identity-aware access at the conduit boundary is the correct pattern. Attempting to push identity enforcement into the Purdue Level 1–2 estate is where OT-inclusive Zero Trust programmes stall permanently. Design for it explicitly; do not discover it in month fourteen.

3.6 Ownership and Authority Mismatch

The decisive stall point is organisational.

Identity is typically owned by IT Operations, with authoritative data in HR and joiner-mover-leaver decisions made by line management. The Zero Trust programme is owned by Security. The programme therefore has a critical-path dependency on a function it does not control, whose performance metrics (service delivery speed, ticket closure, user satisfaction) are structurally opposed to its own (least privilege, friction at the decision point, revocation velocity).

No amount of architecture corrects a governance defect. Where the ZTA programme owner lacks change authority over identity lifecycle and entitlement management, the programme will stall at identity regardless of budget, tooling, or executive enthusiasm. This is the finding PRAECEPTA surfaces most often and the one clients are least prepared to hear.

4. MEA-Specific Stall Accelerants

The generic stall points apply globally. Four factors amplify them materially in this region, and they are largely absent from Western-authored Zero Trust literature.

Identity resolution across script and transliteration boundaries. Arabic-to-Latin transliteration is non-deterministic. A single individual may exist as Mohammed, Mohamed, Muhammad, and Mohd across HR, AD, payroll, and a SaaS tenant — plus an Arabic-script record in a government-facing system. Deterministic matching fails; probabilistic matching introduces false merges with severe access-control consequences. This is a genuine, under-discussed engineering problem in GCC and North African identity estates and it directly obstructs Stall Point 3.1.

Sponsorship-based employment lifecycle divergence. In GCC jurisdictions, the authoritative event for workforce exit is frequently visa cancellation or sponsorship transfer, processed through PRO/government-relations functions on timelines that are not integrated with HRIS. The HR system is therefore not the authoritative leaver source, yet virtually every IGA deployment configures it as such. The result is systematic deprovisioning latency invisible to the control owner.

Contractor and third-party density. Large GCC enterprises and government entities operate with contractor proportions well above global norms, often via multi-tier subcontracting on major infrastructure and giga-projects. These identities are numerous, short-lived, externally sponsored, and frequently provisioned outside standard workforce process. This is simultaneously a Zero Trust stall point and a NIST SP 800-161r1 supply-chain exposure.

Data residency constraints on the identity control plane. Identity is high-sensitivity personal data. Where NCA ECC-1:2018, UAE PDPL, UAE IA requirements, DIFC DP Law 2020, ADGM DPR 2021, Qatar NIA, Kenya DPA 2019, or POPIA apply, the location of the IdP, the IGA data store, the behavioural analytics engine, and the log estate all become regulated architectural decisions. Several leading identity platforms lack in-region tenancy or offer it with reduced feature parity. Programmes that select tooling before resolving residency incur rework precisely at the point of identity integration. Where an entity also carries DORA or NIS2 exposure through EU operations, conflicting requirements must be reconciled at design time.

This constitutes security architecture guidance, not legal advice. Engage qualified local counsel for binding interpretation of data localisation and cross-border transfer obligations in each applicable jurisdiction.

5. The Trust Spine: A Sequencing Model That Avoids the Stall

The standard remedy — "fix identity first" — is wrong. It produces a two-to-three-year foundational programme with no demonstrable security outcome, which loses funding in year two.

PRAECEPTA's prescription is a narrow vertical slice, built to full depth: one complete, production-grade trust path from subject through PDP to a single high-value resource, with every layer genuinely operating at ZTA tempo. Then replicate laterally.

Establish the identity resolution spine before any enforcement work. One authoritative registry of resolvable entities — human and non-human — with a named accountable owner per identity. Solve transliteration and sponsorship-source problems here. Target: >98% of active credentials mapped to an accountable owner.
Instrument entitlement debt before attempting to reduce it. Measure granted-versus-exercised entitlements for 90 days. This converts an unbounded political argument into an evidence-based reduction backlog with quantified risk. It is also the single most effective board artefact available to a stalling programme.
Fix revocation velocity before refining grant logic. Counter-intuitive, and the highest-leverage move available. Most programmes optimise the grant decision while revocation remains manual and slow. An architecture that grants precisely and revokes slowly is weaker than one that grants coarsely and revokes in seconds.
Bring non-human identity into scope from day one, not phase three. Given the estate ratios, an identity programme scoped to the workforce is a rounding-error programme. Establish NHI inventory, ownership, credential rotation, and — critically — a delegation and revocation model that anticipates agentic AI.
Declare the enforcement floor explicitly. Formally document where identity-level enforcement is not achievable (OT Levels 0–2, specified legacy platforms) and apply compensating zone-and-conduit controls per IEC 62443. An honest, board-approved floor prevents the indefinite deferral that a hidden floor guarantees.
Resolve authority before architecture. Secure written change authority over identity lifecycle and entitlement management for the ZTA programme owner, or restructure the programme's scope to match actual authority. Do not proceed on the assumption that goodwill will substitute.

6. The Identity Control Plane Scorecard

Programmes stall partly because they measure deployment rather than trust dynamics. PRAECEPTA recommends five metrics, all board-reportable.

Metric	Definition	Indicative target
Mean Time to De-Trust (MTTD-t)	Trust-invalidating event → enforced revocation across all PEPs	<15 min (human), <60 min (NHI)
Identity Resolution Coverage	% of active credentials mapped to a uniquely resolved, accountable owner	>98%
Entitlement Debt Ratio	Entitlements granted ÷ entitlements exercised in trailing 90 days	<1.5:1 for privileged access
Signal Freshness at Decision	% of access decisions made on context signals under 5 minutes old	>90% for high-value resources
PEP Coverage	% of access paths to in-scope resources fronted by a PEP	>95%, with documented floor

MTTD-t is, in our assessment, the most under-used metric in Zero Trust practice. It is the honest measure of whether an organisation has continuous verification or merely continuous authentication — and it maps directly to reportable control effectiveness under NCSC CAF v4.0 (Objective B2), NCA ECC-1:2018 domain 2-2, SAMA CSF identity and access requirements, and NIST CSF 2.0 PR.AA.

7. The Board Framing

For directors, the message compresses to three sentences.

Zero Trust spend on network and endpoint enforcement does not deliver its expected risk reduction until identity operates at the same tempo as enforcement. The gap between those two tempos is measurable, and it is currently unmeasured in most organisations. The organisation should be asked one question at the next risk committee: how long does it take, from the moment we decide a person or a machine credential should no longer have access, until that access actually stops everywhere?

If the answer is not known, the Zero Trust programme has already stalled at identity — whether or not anyone has said so.

PRAECEPTA Position

Zero Trust is an architecture of continuous, evidence-based trust decisions. Identity is not a component of that architecture — it is the substrate. Programmes that treat identity as a work package to be scheduled will stall at identity. Programmes that treat identity as the control plane, and measure it as one, will not.

The regional dimension matters. MEA enterprises face identity resolution, workforce lifecycle, third-party density, and data residency conditions that generic Zero Trust guidance does not address. Firms that import Western reference architectures unmodified will encounter the stall at higher cost and later in the programme.

This constitutes security architecture guidance, not legal advice. Regulatory obligations under NCA, SAMA, UAE IA, UAE PDPL, DIFC, ADGM, Qatar NIA, CBB, Kenya DPA, POPIA, NIS2, and DORA require interpretation by qualified counsel in the relevant jurisdiction.