.png)
Zero trust has moved from buzzword to baseline. Organizations that have deployed zero trust architecture save an average of $1.76 million per breach compared with peers that have not, according to the IBM 2025 Cost of a Data Breach Report. The global zero trust security market sits at $36.5 billion in 2024 and is projected to reach $78.7 billion by 2029, per MarketsandMarkets. Sixty-one percent of organizations worldwide have launched a zero trust initiative, up from 24% in 2021 per the Okta State of Zero Trust Security report. And the threat model that zero trust is designed to defeat keeps proving the point: 22% of breaches in 2025 began with credential abuse, per the Verizon 2025 Data Breach Investigations Report. These are the zero trust statistics IT, security, and compliance leaders should know in 2026.
Key zero trust statistics at a glance
- $1.76 million average breach cost savings for organizations with a zero trust architecture in place, ranking it among the top four cost-reducing controls, per the IBM 2025 Cost of a Data Breach Report.
- $4.44 million global average cost of a data breach in 2025, down 9% from $4.88 million as AI-led detection cut mean time to contain to 241 days, per IBM.
- 22% of all 2025 breaches began with credential abuse, the single largest initial-access vector, per the Verizon 2025 DBIR. Another 88% of basic web application attacks involved stolen credentials.
- Over 99% of identity-based attacks can be blocked by phishing-resistant multi-factor authentication, a core zero trust control, per the Microsoft Digital Defense Report 2025.
- 7,000 password attacks per second were blocked by Microsoft Entra in 2025, with identity-based attacks surging 32% in the first half of the year, per the Microsoft Digital Defense Report 2025.
- 10% of large enterprises are predicted to have a mature, measurable zero trust program in place by 2026, up from less than 1% in 2023, per Gartner.
- 75% of U.S. federal agencies are predicted to fail full zero trust implementation through 2026 due to funding and expertise shortfalls, per Gartner.
- $36.5B to $78.7B is the projected growth path of the global zero trust security market from 2024 to 2029, a 16.6% CAGR, per MarketsandMarkets.
61% of organizations globally have launched zero trust initiatives, with another 35% planning to soon and 91% saying identity is central to their strategy, per Okta.
Zero trust adoption is broad but maturity is rare
The headline adoption numbers look strong. Per the Okta State of Zero Trust Security report, 61% of organizations worldwide say they have launched a zero trust strategic initiative, almost triple the 24% figure from 2021. Another 35% say they plan to start soon, which puts the share of organizations either doing or planning zero trust work near 96%. The same Okta survey found that 91% of respondents rate identity as important to their zero trust strategy, and that 80% of organizations have grown their zero trust budgets year over year even when other security spending tightened.
Maturity is a different story. Per a 2023 Gartner forecast, only 10% of large enterprises will have a mature and measurable zero trust program in place by 2026, up from less than 1% in 2023. Mature in Gartner's definition requires continuous evaluation of identity, device, and session risk across the whole estate, not just a few zero trust pilots. The gap between organizations that say they are doing zero trust and organizations that have an instrumented, end-to-end program is wide.
Identity sits at the center of that gap. The Microsoft Digital Defense Report 2025 shows why: password-based attacks now make up more than 99% of the roughly 600 million daily identity attacks against Microsoft Entra, and identity-based attacks rose 32% in the first half of 2025. Microsoft blocked 7,000 password attacks per second over the past year. Phishing-resistant MFA stops more than 99% of those attacks even when the attacker already has valid credentials, which is why every zero trust framework treats it as a non-negotiable starting point.
ZTNA is replacing the VPN as the standard remote access pattern
Zero trust network access (ZTNA), the segment of zero trust that handles user-to-application connectivity, is growing faster than the broader market. Per MarketsandMarkets, the global ZTNA market is projected to grow from $1.34 billion in 2025 to $4.18 billion by 2030, a 25.5% CAGR. That is well above the 16.6% CAGR for the broader zero trust market.
Gartner expected the shift years ago. Its ZTNA market forecast predicted that by 2025, at least 70% of new remote access deployments would be served predominantly by ZTNA rather than VPN services, up from less than 10% at the end of 2021. The 2025 reality is broadly tracking that path: per the Okta State of Zero Trust, the share of organizations with passwordless and identity-centric remote access plans on the next 12-to-18 month roadmap has now passed 18% in North America alone, with similar momentum globally.
The convergence with secure access service edge (SASE) is the next phase. Vendors are increasingly bundling ZTNA, secure web gateway, cloud access security broker, and firewall-as-a-service in one identity-aware stack. Per MarketsandMarkets, that bundling is one of the main drivers behind the broader zero trust market's 16.6% CAGR through 2029.
Why identity-centric controls are the highest-leverage zero trust investment
Every authoritative threat report points to the same conclusion: identity is now the perimeter. The Verizon 2025 Data Breach Investigations Report analyzed more than 22,000 incidents and found that credential abuse was the single most common initial access vector in 22% of breaches. Stolen credentials drove 88% of basic web application attacks, a category that includes the bulk of small-business compromises. Among ransomware victims whose data was disclosed in 2024, 54% had their corporate domains appear in credential marketplace dumps and 40% had corporate email addresses among the compromised credentials.
Infostealer malware is reshaping the credential supply chain. Per Verizon, analysis of infostealer logs showed that 30% of the compromised systems could be identified as enterprise-licensed devices, and 46% of those systems with corporate logins were non-managed devices hosting both personal and business credentials. That mixed personal-and-work footprint is exactly the scenario zero trust device-posture checks are designed to break: a device that fails compliance does not get access regardless of whether its credentials are valid.
Credential stuffing is now industrial-scale. Per the same Verizon DBIR, the median daily share of credential stuffing across SSO provider logs reached 19% of all authentication attempts. The Microsoft Digital Defense Report 2025 adds context: 97% of identity attacks are password attacks, and MFA blocks access in more than 99% of cases where attackers possess valid usernames and passwords. The takeaway is straightforward. Organizations that pair MFA with conditional access on every application reduce identity-driven breach risk by orders of magnitude.
Federal and DoD zero trust mandates are setting the global pace
The U.S. government is the largest single zero trust customer in the world, and its mandates are reshaping vendor roadmaps. The Office of Management and Budget's Federal Zero Trust Strategy (M-22-09), issued in January 2022, required all federal civilian agencies to meet specific zero trust goals across five pillars (identity, devices, networks, applications and workloads, and data) by the end of fiscal year 2024. Each agency had to designate a zero trust implementation lead within 30 days and submit a multi-year implementation plan covering FY 2022 through FY 2024 within 60 days.
The Department of Defense set its own deadline. Per the DoD Zero Trust Strategy, DoD components and supporting contractors must achieve Target Level zero trust by the end of FY 2027, with 91 of 152 activities marked as the baseline. A fully optimized Advanced Level is due by FY 2032. The strategy organizes work across seven pillars: users, devices, applications and workloads, data, network and environment, automation and orchestration, and visibility and analytics. Within those seven pillars, the DoD defined 45 separate capabilities, each broken into associated activities.
The reality on the ground is mixed. Per a March 2024 Gartner forecast, 75% of U.S. federal agencies will fail to fully implement zero trust security policies through 2026 because of funding gaps and expertise shortfalls. Gartner cited siloed legacy systems, limited budget for the cultural and process work zero trust requires, and shortages of skilled personnel as the biggest obstacles. Civilian agency CIOs have publicly said that the end-of-FY-2024 OMB deadline produced strong progress on identity and device pillars but left the data pillar far behind.
Barriers to zero trust implementation
The biggest barriers are organizational, not technical. The same Gartner forecast that flagged 75% federal failure also identified the root causes across enterprises: legacy infrastructure that was never designed for identity-based access, integration complexity across hybrid and multi-cloud estates, and an industry-wide shortage of architects experienced enough to run a full implementation. Cost overruns are the predictable result. Most large zero trust rollouts that miss their target dates do so because the budget assumed a tooling problem and discovered a process problem.
Identity sprawl is the second-largest barrier. The Okta State of Zero Trust report shows that 91% of organizations call identity central to their strategy, yet the same survey found that the average enterprise still uses dozens of identity stores that do not talk to each other. Consolidating user, device, service, and machine identities into a single source of truth is usually the longest single workstream of any zero trust program.
Legacy applications are the third barrier and the most stubborn. Many enterprise systems were built on implicit trust within the corporate network, with no support for modern authentication protocols, no API to expose session telemetry, and no way to enforce per-request access decisions. The OMB M-22-09 memo explicitly told federal agencies to plan for application modernization as part of zero trust, not as a separate program. Most enterprises now do the same: zero trust spending and application modernization spending are increasingly treated as a single budget line.
Zero trust ROI and breach economics
The economic case for zero trust got a major boost from the IBM 2025 Cost of a Data Breach Report, which named zero trust architecture among its top four cost-reducing controls. The numbers are concrete: a tested incident response plan saved $2.66 million on average, extensive use of AI and automation in security operations saved $1.9 million, zero trust architecture saved $1.76 million, and law enforcement involvement saved $990,000. Organizations with all four in place saw average breach costs below $2 million, less than half the global average of $4.44 million.
Breach economics overall improved for the first time in years. Per IBM, the global average cost of a data breach fell 9% in 2025 to $4.44 million from $4.88 million the year prior. The mean time to identify and contain a breach dropped to 241 days, the lowest in nine years. IBM attributes the drop to AI-augmented detection and the maturing of automated response. Zero trust played a role too: organizations with identity-centric access controls and microsegmentation simply give attackers less time and less room to escalate before being caught.
There is a flip side, though. The 2025 IBM analysis on AI risk, which accompanies the Cost of a Data Breach Report, warned that shadow AI inside organizations is creating a new cost vector, with companies that had ungoverned AI tooling paying roughly $670,000 more per breach on average. Zero trust principles like continuous verification, least privilege, and microsegmentation extend naturally to AI workloads, which is one of the reasons demand for zero trust controls on AI usage has spiked in 2026.
Microsegmentation, MFA, and the core zero trust controls
A zero trust architecture is the sum of its components. The DoD Zero Trust Strategy defines seven pillars (users, devices, applications and workloads, data, network and environment, automation and orchestration, visibility and analytics) and breaks them into 45 capabilities and 152 activities. Civilian agencies under the OMB M-22-09 framework work with a similar five-pillar structure. In both models, three controls do most of the heavy lifting: phishing-resistant MFA, continuous device posture assessment, and microsegmentation.
Phishing-resistant MFA is the single highest-impact control. Per the Microsoft Digital Defense Report 2025, MFA blocks more than 99% of identity-based attacks even when the attacker has valid usernames and passwords. The catch is that not all MFA is created equal: SMS-based codes and push notifications without number matching remain vulnerable to social engineering. Phishing-resistant MFA based on FIDO2 or platform passkeys is now the federal baseline under OMB M-22-09 and is moving into the private-sector baseline as well.
Device posture is the second pillar. Per the Verizon DBIR, 46% of compromised systems that contained corporate credentials were non-managed devices. Zero trust device-posture checks block authentication from any device that fails compliance, even if the credentials are valid, which closes the most common BYOD compromise path.
Microsegmentation is the third pillar, and the one most likely to limit blast radius once a breach happens. The IBM 2025 Cost of a Data Breach Report attributes a meaningful portion of the $1.76 million zero trust savings to microsegmentation: when an attacker compromises one workload but cannot move laterally, the breach stays contained, the cleanup is cheaper, and regulatory disclosure obligations are narrower.
Emerging zero trust trends in 2026
Zero trust is extending to AI workloads. Per the IBM 2025 Cost of a Data Breach Report, organizations with ungoverned shadow AI in their environments paid roughly $670,000 more per breach on average. The fastest-growing zero trust use case in 2026 is identity-centric access control over AI model endpoints, data pipelines, and agent-driven automation.
Federal procurement is reshaping the vendor market. Per the DoD Zero Trust Strategy, every DoD contractor must achieve Target Level zero trust by FY 2027. That cascading mandate is forcing thousands of defense suppliers to roll out zero trust controls, which in turn is pulling the broader U.S. enterprise market forward.
SASE and ZTNA convergence is the dominant procurement pattern. Per MarketsandMarkets, the ZTNA segment is growing at 25.5% CAGR, well above the broader zero trust market's 16.6%, and the strongest growth is in bundled SASE platforms that combine ZTNA with cloud security gateways. Buyers are consolidating on platforms rather than buying point tools.
Phishing-resistant MFA is becoming the new baseline. Per the Microsoft Digital Defense Report 2025, identity-based attacks grew 32% in the first half of 2025. Phishing-resistant MFA blocks more than 99% of them. Both the OMB M-22-09 strategy and the DoD Zero Trust Strategy now require phishing-resistant factors, and major enterprises are following.
Identity for non-human actors is the next frontier. Per the Verizon DBIR, a growing share of compromises involve service accounts, machine identities, and API tokens rather than human users. Zero trust programs in 2026 are increasingly extending continuous verification and least privilege to service-to-service traffic, not just person-to-application traffic.
Maturity is finally getting measured. Per Gartner, only 10% of large enterprises will have a mature, measurable zero trust program by 2026 even though most claim to be doing zero trust. Measurement frameworks built on the CISA Zero Trust Maturity Model and the DoD's capability-based scoring are starting to show up in board reporting, which is forcing organizations to substantiate their claims with telemetry rather than projects.
For broader context on the trends above, see our cloud security statistics and insider threat statistics roundups.
How swif.ai helps
swif.ai gives IT and security teams a single console to enforce device, identity, and compliance controls across the macOS, Windows, and Linux endpoints behind the numbers above. Explore swif.ai unified endpoint management to see how it works.
.webp)
