Almost every client conversation about zero trust starts the same way: a vendor has already been in the room before me, and there's a product name attached to the concept. Something gets bought. A dashboard appears. And six months later the architecture underneath hasn't actually changed — there's just a new login screen in front of the old assumptions.
Zero trust isn't a thing you install. It's a standing decision to stop trusting network location, and to verify every request against identity and context instead — every time, not just at the perimeter.
Where the gap usually is
In engagements, the gap between "we bought zero trust" and "we practice zero trust" tends to show up in the same few places:
- Implicit trust inside the VPN. Traffic that's already past the VPN gateway is often treated as verified, when the VPN was only ever a network boundary, not an identity check.
- Service-to-service calls with no re-authentication. A request that hops between three internal services frequently carries the trust of the first hop all the way through, with no per-hop verification.
- Long-lived credentials that outlive the reason they were issued. Tokens and service accounts that were scoped for a project that ended a year ago, still valid, still trusted.
None of these are solved by a product sitting at the network edge. They're solved by an organization deciding, as policy, that every request gets checked against who's making it, from what, and why — and then actually building the plumbing to check that consistently.
What the habit looks like in practice
The engagements that actually shift posture tend to share a few traits:
- Access reviews happen on a schedule, not just when someone remembers to run one.
- Service accounts and tokens have an expiry baked in from creation, not bolted on after an audit finding.
- Segmentation is treated as a living map that gets redrawn as the architecture changes, not a diagram from the original rollout.
A zero trust architecture diagram is worth exactly as much as the last time someone checked it against reality.
The product can help enforce the habit once it exists. It can't create the habit on its own — that part is organizational, and it's the part nobody wants to hear during the sales call.