Zero Trust verifies the connection, not the command
Ransomware moves through a fully microsegmented network using domain credentials it stole. Every connection is policy-compliant. Every authentication succeeds. The architecture worked as designed, and the design does not cover this.
What does Zero Trust verify?
The connection. It replaced trust-by-network-position with per-connection authentication, authorisation and posture evaluation, which was a genuine improvement. The unit of verification moved from the segment to the connection — and not to the action, which is where an attacker with valid credentials operates.
- Zero Trust replaced implicit network trust with explicit per-connection verification. The unit of verification is still a connection.
- An attacker with valid credentials satisfies every connection-time check, because the checks are about identity and posture rather than intent.
- Extending verification to the action — requiring a fresh, bound proof for irreversible commands — covers the gap the connection model leaves.
Part of Privileged identity and account recovery
What Zero Trust actually replaced
The old model granted trust by network position: inside the perimeter meant trusted. Zero Trust removed that assumption and required every connection to be authenticated, authorised and evaluated against device posture.
This was a substantial improvement and should not be undersold. Flat networks where a single foothold reached everything are genuinely worse.
But look carefully at what changed. The unit of verification moved from the network segment to the connection. It did not move to the action.
The attacker's view
| Check at connection time | What an attacker with valid credentials presents |
|---|---|
| Identity authenticated | A real account, authenticated normally or via a stolen session |
| Device posture compliant | The victim's managed device, fully compliant |
| Authorisation policy evaluated | Access the account genuinely has |
| Location and risk signals | The victim's network and typical geography |
| Continuous re-evaluation | Nothing changes — the signals stay clean |
Every row passes. Not because the controls are weak, but because they are evaluating the right things about the wrong subject. The connection is legitimate; the intent behind it is not, and intent is not a connection property.
Why lateral movement still works
Microsegmentation limits which systems an identity can reach. Administrative and service identities, by function, need to reach many systems.
So segmentation constrains the compromise of a marketing analyst's account effectively, and constrains the compromise of a domain administrator's account hardly at all. The identities worth stealing are the ones whose legitimate scope is broad.
Tightening those scopes is worthwhile and has a floor: an administrator who cannot administer is not an administrator.
Moving verification to the action
The extension is straightforward to state. For a defined set of irreversible operations, the connection's authority is insufficient; the operation requires a fresh proof bound to what it will do.
# Connection-time (existing Zero Trust)
identity ✓ device ✓ policy ✓ → connection established
# Action-time (the extension)
operation: "encrypt_volume" | "delete_backup" | "disable_logging"
→ requires assertion over the rendered operation
→ fresh (< 2 min), user-verified, bound to this instance
→ absent or mismatched: refused
# Ransomware holding valid domain credentials
# passes every connection-time check
# cannot produce the assertion
# is stopped at the operation that mattersThe gated set is small and consistent across environments: backup deletion, retention changes, logging and telemetry disablement, mass encryption or permission rewrites, credential creation.
Why these operations specifically
They are the prerequisites for the damage rather than the damage itself. Ransomware deletes backups before encrypting, disables logging before moving, and creates persistence credentials early.
Gating the prerequisites is more effective than trying to gate every write, and it is tractable: there are perhaps a dozen such operations in a typical estate.
What this is not
It is not a replacement for Zero Trust architecture. Connection-time verification, segmentation and posture checks all remain necessary; removing them would be a straightforward regression.
It is also not a claim that action-time verification stops everything. An attacker present on an endpoint at the moment a legitimate user approves an operation can obtain that one action. That is a much harder attack with a much smaller yield than holding credentials that authorise thousands.
A sequencing note
Organisations often approach this in the wrong order — pursuing exhaustive microsegmentation for years before considering action-level controls.
The inverse tends to deliver more. Gating a dozen operations is weeks of work and blunts the most damaging attack patterns. Segmentation is a multi-year programme whose benefit accrues gradually and which, for administrative identities, has a low ceiling.
The dozen operations worth gating
Ransomware deletes backups before encrypting, disables logging before moving, and creates persistence credentials early. Gating the prerequisites is more effective than gating every write, and it is tractable.
| Operation | Why it is a prerequisite |
|---|---|
| Backup deletion | Removes recovery |
| Retention configuration change | Removes recovery, quietly |
| Logging or telemetry disablement | Removes detection |
| Mass encryption or permission rewrite | The damage itself |
| Credential creation | Persistence |
Objections and honest limits
“Is Zero Trust a failed model?” No. Removing implicit network trust was a large and real improvement. Its unit of verification is the connection, and some attacks operate entirely inside authorised connections.
“Should we stop investing in segmentation?” No, but consider sequencing. Gating a dozen operations takes weeks; comprehensive segmentation takes years and has a low ceiling for privileged identities, which are the ones worth stealing.
Extending verification to the action
- List the prerequisite operations. Around a dozen in a typical estate.
- Require a fresh bound assertion for each. Rendering the operation and its blast radius.
- Enforce at the operation, not at the connection. In-flight work is already past the gateway.
- Keep the connection-time controls. Removing them would be a straightforward regression.
Terms used here
- Microsegmentation
- Constraining which systems an identity can reach — effective for narrow identities, limited for administrative ones.
- Lateral movement
- Moving between systems using valid credentials, which passes every connection-time check.
- Prerequisite operation
- An action an attacker performs before the damage, such as deleting backups or disabling logging.
Frequently asked questions
Is Zero Trust a failed model? No. It removed implicit network trust, which was a real and large improvement. Its unit of verification is the connection, and some attacks operate entirely inside authorised connections.
Why doesn't microsegmentation stop lateral movement? It constrains identities with narrow legitimate scope. Administrative and service identities need broad reach by function, and those are the identities attackers target.
How many operations need action-time verification? Typically around a dozen: backup deletion, retention and logging changes, mass encryption or permission rewrites, credential creation.
Should we stop investing in segmentation? No, but consider sequencing. Gating a dozen operations takes weeks; comprehensive segmentation takes years and has a low ceiling for privileged identities.
Is Zero Trust failing? No. It removed implicit network trust, which was a real improvement. Its unit of verification is the connection, and some attacks live inside authorised connections.
Why doesn't segmentation stop lateral movement? It constrains identities with narrow legitimate scope. Administrative and service identities need broad reach by function, and those are what attackers target.
Where this fits in Manav
Manav requires a fresh assertion bound to the specific action, from a credential under the person's sole control. A stolen session reaches the endpoint and cannot produce it.