Zero Trust Gaps Persist When Identity, Device, Network Silos Remain

Zero Trust architecture has become a foundational principle for government and enterprise cybersecurity, but a new guest opinion published by iTWire argues that its promise is undermined when core enabling systems operate in isolation. The article, authored by Amanda Spencer, Senior Director of APAC Systems Engineering at Extreme Networks, contends that identity, device posture, and network enforcement must be woven together to deliver consistent, continuously updated access decisions. For government contractors and procurement officials evaluating security technology, the piece serves as a capability consideration rather than a compliance mandate — but one that could reshape how Zero Trust solutions are scoped, tested, and scored in future acquisitions.

The article traces Zero Trust back to its origins. The concept was coined by John Kindervag while at Forrester Research in 2010, challenging the long-held assumption that users and devices should be trusted simply because they connect to an internal network. More than a decade later, the principle is widely accepted, yet many organizations still struggle to translate it into consistent operational practice. Extreme Networks, which is cited as the source of the guest opinion, clearly has a commercial interest in the integration argument, but the underlying problem it describes — fragmentation across security domains — is well documented across public-sector environments as well.

The core issue is not a lack of investment. Many organizations already maintain an identity provider (IdP) that authenticates users and supplies attributes such as role, group membership, and privileges. They run a mobile device management (MDM) platform that monitors device ownership and security posture. They also operate a network connecting people, applications, and systems. According to the article, however, these capabilities frequently operate in silos. An IdP can establish who someone is, while MDM can report whether a laptop meets security requirements. Unless those signals actually inform access decisions across the network and applications, successful authentication can still lead to excessive access.

Spencer illustrates the gap with a contractor scenario. A contractor may successfully sign into an application, with their identity verified — but that does not mean they should receive the same access as a permanent employee. Nor does authentication establish whether the device is managed or potentially compromised. The same weakness emerges when an employee changes location or a device falls out of compliance. A policy applied on office Wi-Fi may differ from one governing a wired connection or remote access. A device check might flag a problem, but that signal has limited value unless access controls can respond. Security teams are left maintaining rules that vary by connection method and require manual intervention to remain current.

That inconsistency becomes acutely dangerous when an account is compromised. An attacker using valid employee credentials could exploit permissions extending beyond the person's immediate work and move deeper into the network. Restricting each connection to the resources it needs limits that opportunity and gives organizations a more precise response when trust in an identity or device changes. For procurement teams, the article's implication is clear: integrated enforcement across wired, wireless, and remote environments should be a key evaluation criterion when assessing Zero Trust solutions. Organizations may benefit from examining whether proposed capabilities apply access controls consistently regardless of how a user connects, and whether identity and device-posture signals are actually correlated with enforcement actions rather than merely logged.

The article identifies no government solicitation, contract, or procurement action. It offers a security-architecture consideration, not a mandatory requirement or a time-bound opportunity. Still, for agencies and contractors building Zero Trust roadmaps — whether in response to U.S. federal mandates, Australian government cyber strategies, or internal security modernization efforts — the fragmentation problem is a practical warning. Buying best-of-breed identity, MDM, and network tools without integration planning can leave a critical gap between login and decision, allowing legitimate credentials to unlock too much.

Key facts and actionable insights:

• Zero Trust was coined by John Kindervag at Forrester Research in 2010; adoption remains strong but operational consistency lags.
• Amanda Spencer, Senior Director, APAC Systems Engineering at Extreme Networks, authored the guest opinion for iTWire on 26 October 2026.
• The article cites no government solicitation, contract, or procurement action; it is a capability consideration for security technology evaluations.
• Fragmentation across identity provider (IdP), mobile device management (MDM), and network enforcement can allow successful authentication to grant excessive access.
• Policy inconsistency across office Wi-Fi, wired, and remote access connections creates manual burdens and potential security gaps.
• Attackers using valid credentials can exploit overly broad permissions when access is not continuously restricted to needed resources.
• Procurement teams should evaluate whether Zero Trust proposals tie identity and device-posture signals directly to consistent access enforcement.
• Agencies and contractors should prioritize integration testing across all connection methods when modernizing security architectures.