Zero Trust Fatigue: Why Half of Rollouts Stall at Phase Two
A survey of 400 CISOs finds identity sprawl, not budget, is the leading cause of stalled zero-trust programs.
Zero trust has been the dominant security strategy of the past five years. Yet a survey of 400 CISOs finds that roughly half of zero-trust programmes stall at phase two — after the initial wins, but long before the architecture is complete. The leading cause is not budget. It is identity sprawl.
Phase one is easy to celebrate
Most programmes begin with visible, achievable steps: multi-factor authentication for all staff, replacing the VPN for remote access, segmenting a few critical systems. These deliver real risk reduction and make good board updates.
Phase two is where the hard work begins.
The identity problem
Zero trust depends on knowing exactly who and what is requesting access. In most enterprises, that picture is a mess.
- Multiple directories from acquisitions and legacy systems
- Thousands of service accounts with unclear owners
- Contractors and partners managed outside central identity systems
- Machine identities for workloads and APIs growing faster than human ones
“We built the policy engine in six months. We're two years into figuring out who all our identities actually belong to.”
How stalled programmes restart
Programmes that regain momentum usually reset the scope. Instead of pursuing zero trust everywhere at once, they choose a single high-value domain — privileged access, a crown-jewel application or a business unit — and complete it end to end.
Identity governance becomes the core workstream rather than a side project. And progress is reported in terms of risk removed, not percentage of architecture complete.
Zero trust fatigue is real. But in most cases it signals a programme that has reached the difficult part, not one that has failed.