Zero-trust security
Zero trust is a set of controls that each organisation has to implement, and no product delivers it on a fixed timetable. April's US guidance extends it to operational technology, the systems that run industrial equipment, and stresses legacy systems and safety constraints. Judge progress by verified access controls, asset visibility and isolation. Enterprises are not all on the same two-to-three-year journey.
Research snapshot · updated Nov 12, 2026
Core thesis
Jay Chaudhry (Zscaler) and John Kindervag (who coined the concept at Forrester in 2010) define zero trust: never trust, always verify. The architecture replaces perimeter-based security (firewalls) with identity-based access control. Zscaler, Cloudflare, and Palo Alto Networks lead. 60%+ of enterprises have started zero-trust journeys; fewer than 20% have completed them.
State of the art (2026)
Zero trust is a set of controls that an organisation puts in place over time. NIST published the final version of SP 1800-35 on 10 June 2025. It documents 19 example implementations of the SP 800-207 model, built with 24 collaborating companies. They are worked examples and do not certify any product or organisation. US guidance issued in April 2026 extends zero trust to operational technology, and stresses the limits set by legacy systems and safety. We do not have confirmed figures for how many enterprises have adopted it or for suppliers' revenue from it.
Explore the deeper analysis in CanaryIQ
Explore what is covered below. These previews show the structure; log in to read the full analysis.
Signal stack
Evidence stacked leading → lagging
9 signals
Signal stack
Evidence stacked leading → lagging
Technology-native KPIs
Metrics that predict trajectory, tracked over time
4 tracked
Technology-native KPIs
Metrics that predict trajectory, tracked over time
Landscape map
Who builds what, and who depends on whom
109 players · 6 layers
Landscape map
Who builds what, and who depends on whom
Catalyst calendar
Dated events that will move the position
4 ahead
Catalyst calendar
Dated events that will move the position
Technology roadmap
Milestones on the path to maturity
8 milestones
Technology roadmap
Milestones on the path to maturity
Watchlists
Companies, people and papers, each with a condition for removing it
20 · 20
Watchlists
Companies, people and papers, each with a condition for removing it
Decision frameworks
What our view means for your job
Locked
Decision frameworks
What our view means for your job
Thesis changelog
When our view changed, and why
8 updates
Thesis changelog
When our view changed, and why
Change our mind
3 disconfirming conditions
You've read the verdict. The file is much deeper.
The full signal stack, technology-native KPIs tracked over time, the landscape of who depends on whom, the dated catalyst calendar, decision frameworks for every desk, live watchlists and a record of every time our view on Zero-trust security has changed. All of it is in CanaryIQ.