15 years in, zero trust remains elusive — with AI rising to complicate the challenge

December 5, 2025 – Published on CSO Online

The zero trust approach cybersecurity access control is more than 15 years old, but organizations continue to struggle with its implementation due in large part to fragmented tooling and legacy infrastructure.

A recent report paints a picture of widespread industry struggles in rolling out zero trust technologies, a perspective in line with the experiences of experts and security practitioners quizzed on the topic by CSO.

Zero trust networking involves applying a security framework where no user or device is trusted by default. Under zero trust, every access attempt is accompanied by authenticating identity and device compliance regardless of whether or not it originates within an organization.

Gary Brickhouse, CISO at GuidePoint Security, notes that an “overly-complex approach” to zero trust has driven up costs and timelines as organizations pursue overly strict alignment with zero trust principles.

“Most organizations would benefit from a simplified risk-based approach, identifying critical use cases that are achievable and deliver the desired outcome of risk reduction,” Brickhouse says. “Early wins improving the security of the organization and moving the ZT [zero trust] needle forward builds confidence across the organization.”

Read More HERE.