Zero Trust describes a cybersecurity strategy in which a system assumes it’s already been breached by bad actors hiding behind legitimate credentials. Rather than barricading the perimeter, this strategy focuses inward, monitoring the digital environment for suspicious behavior by comparing real-time activity to a baseline of how credentialed users are expected to behave within the system. The Cybersecurity and Infrastructure Security Agency (CISA) outlines the traditionally accepted framework for Zero Trust assessment in their Zero Trust Maturity Model (ZTMM). This model measures the maturity level of: Visibility and analytics Automation and orchestration Governance Across five pillars: Identity Devices Network Apps and Workloads Data Using ratings: Traditional Initial Advanced Optimal But we’ve identitfied a fundamental flaw in CISA’s ZTMM: Identity’s role is misunderstood. So what is that role? Let’s dive in. Identity is the center of everything With a Zero Trust strategy, the system is looking for users.