Zero Trust Is 15 Years Old — Why Full Adoption Is Worth the Struggle

Zero Trust is 15 years old, having turned fifteen on 14 September 2025, and while it remains a leading cybersecurity principle, its uneven implementation leaves many organisations both stronger in some parts and dangerously exposed in others. The article argues that zero trust isn’t failing, but the implementation of zero trust is not complete, describing it as a curate’s egg that is good in parts.

It notes that the concept originated with John Kindervag, whose 2010 paper No More Chewy Centers introduced the model, and that its influence culminated in EO14028 mandating federal agencies move toward a zero trust architecture while private companies should do similarly. The piece also cites Europe’s NIS2 Directive as encouraging basic cyber hygiene practices including zero-trust principles, though it is a directive rather than a law.

Advocates highlight that zero trust should be data-centric, not person-centric, and emphasise continuous verification across all layers, with a recognised need for technology and process changes to reduce insider risk and limit lateral movement.