Most Zero Trust rollouts in the UAE and wider GCC do not stall because the network diagram is wrong. They stall because identity verification was never actually enforced end to end, so segmentation and policy controls get built on a foundation that still trusts anyone holding a valid-looking session. Fix identity and privileged access first, then segment, then enforce policy at the resource. That order is what holds up when an assessor starts asking for evidence.
- Zero Trust is defined by NIST SP 800-207 around policy decision and policy enforcement points, not by any single vendor's box
- Identity is the real perimeter: legacy authentication protocols and standing privileged access break the model before segmentation is ever tested
- Service accounts, break-glass admins and third-party VPN access are the identities most rollouts forget to bring into scope
- The sequence that works is identity hardening and privileged access cleanup first, segmentation and enforcement points second, continuous monitoring last
What Zero Trust Actually Means
NIST SP 800-207 gives the closest thing to a working definition: a policy engine and policy administrator decide, per request, whether a subject gets access to a resource, and a policy enforcement point carries out that decision. The inputs to the decision include user identity, device posture, resource sensitivity and behavioural signal, not the subnet the request came from.
That definition matters because most vendor pitches compress it into a single control, usually micro-segmentation or a ZTNA gateway replacing VPN. Segmentation and ZTNA are real components, but neither is Zero Trust on its own. An organisation can put a ZTNA gateway in front of every application and still have no Zero Trust, because the identity behind each session was never verified past a static password, and that account still holds standing access to everything it touched five years ago.
Why Identity Verification Is Where This Breaks First
Legacy Authentication Protocols Bypass Every Policy You Wrote
NTLM, legacy SMB, POP3/IMAP basic auth and unconstrained Kerberos delegation do not carry the signal a policy engine needs. If a domain still allows NTLM fallback, an attacker who compromises one workstation can authenticate to file shares and application servers without ever touching the conditional access policy that supposedly gates everything else. Modern identity platforms such as Entra ID can enforce phishing-resistant authentication and continuous access evaluation, but only for protocols that actually route through them. Legacy protocol traffic is invisible to that layer by design, which is exactly why it is worth auditing before any segmentation project starts, not after.
Service Accounts and Standing Privileged Access
The identity gap that shows up most often in assessments is not the human workforce, it is the accounts nobody reviews: service accounts with domain admin rights left over from a one-off migration, break-glass accounts with no expiry, and third-party vendor access that was never time-boxed. Least privilege only holds if privileged sessions are checked out, time-limited and recorded rather than standing. This is where a privileged access management platform earns its budget line: without session brokering and just-in-time elevation, "least privilege" stays a policy document instead of an enforced state.
Multi-Factor Authentication Coverage Gaps
Full MFA coverage sounds solved until you count service accounts, legacy on-premises applications that cannot call an identity provider, and emergency accounts exempted from policy for operational reasons. Every exemption is a bypass path an assessor will ask you to justify individually. In most environments MFA coverage is high for interactive human logins and considerably lower for everything else, and closing that gap is slower work than the segmentation project that usually gets the budget instead.
Network Segmentation Comes Second, Not Instead
Segmentation reduces blast radius once identity is verified; it does not substitute for identity verification. A flat network with strong identity controls is still exposed to any account that gets compromised, because compromise now travels through legitimate, authenticated sessions rather than open ports. A heavily segmented network with weak identity controls just gives an attacker more VLANs to request access to, one convincing phishing email at a time. The pattern worth naming: organisations that segment a network and call it Zero Trust, while leaving flat, unauthenticated trust between the segments themselves, usually because the segmentation project ran on a different budget and timeline than the identity project, and nobody reconciled the two. That specific gap, and how lateral movement actually exploits weak segmentation, is worth reading in more detail.
What Assessors Actually Ask For
Whether the driver is CBUAE guidance, an ISO 27001 surveillance audit, or a customer due-diligence questionnaire, the evidence requests tend to converge on the same list: conditional access policy exports showing which applications are covered and which are exempted, a current inventory of privileged and service accounts with last-review dates, MFA coverage broken out by account type rather than one headline percentage, network diagrams showing enforcement points between segments rather than just the segments themselves, and logs showing access decisions are evaluated per session rather than cached indefinitely. None of this requires a specific product. It requires the underlying controls to exist and be documented in a form an auditor can sample against.
A Phasing Order That Actually Survives Contact With a Legacy Estate
- Inventory and classify identities: human, service, break-glass, and third party, with an owner and a review cadence for each.
- Close the MFA and legacy protocol gaps for the accounts that matter most first: domain admins, anything with access to regulated data, and any account with standing access to more than one system.
- Move standing privileged access into a brokered, time-limited model before touching network architecture.
- Segment around the resources that actually matter, not the whole estate at once, and put a policy enforcement point at each boundary, following a proper zero trust network access architecture rather than a static firewall rule.
- Feed access decisions and anomalies into the SIEM so continuous verification produces evidence, not just theoretical coverage.
Where This Order Usually Gets Skipped
The most common shortcut is starting at step 4 because a segmentation or ZTNA project already has budget approval and a vendor relationship attached, while the identity inventory in step 1 has no owner and no line item. The result is a segmented network that still trusts whatever identity walks through the enforcement point, which is the same failure mode as no segmentation at all, just with more moving parts to maintain.
People Also Ask
What is the actual difference between Zero Trust and a traditional perimeter model?
A perimeter model grants broad trust once a user or device is inside the network boundary, typically after a VPN login. Zero Trust evaluates every request against identity, device posture and resource sensitivity regardless of network location, so a compromised account inside the network gets the same scrutiny as one outside it.
Does moving to Zero Trust slow down applications or the user experience?
Poorly tuned policy engines add latency, particularly when every request triggers a full re-evaluation against a slow directory or an overloaded proxy. Well-scoped continuous access evaluation, cached appropriately for low-risk sessions and stepped up only when risk signal changes, adds negligible overhead for most business applications. The performance complaints usually trace back to under-provisioned identity infrastructure, not to the Zero Trust model itself.
The Decision Rule
Before approving a Zero Trust budget line, ask what happens to a specific privileged account, right now, if its password leaks. If the honest answer involves standing access to multiple systems and no time-limited session brokering, spend on identity and privileged access management before spending on segmentation or a ZTNA gateway. Segmentation without that foundation buys a more complicated network, not a more resistant one.
