Zero trust grows up: identity overload, sovereignty showdowns, and the end of checkbox cloud security

By early 2026, experts like Leanne and Brandon underscored that Zero Trust security demands dismantling organizational silos and fostering continuous, cross-functional communication among identity, network, and security teams to embed its principles into the operational fabric. This integrated approach is crucial for achieving granular visibility into data flows and enforcing least privileged access holistically, rather than in isolated pockets, ensuring that Zero Trust decisions endure over time.

Zero Trust fundamentally redefines security by shifting focus from traditional perimeter defenses to continuous verification of both devices and users, emphasizing data-centric control. As one analyst put it, 'you don't have a perimeter anymore,' highlighting that both the device and human must be authorized to communicate, which marks a strategic pivot from legacy models to a dynamic, identity- and context-aware framework.

Despite its revolutionary framing, Zero Trust is essentially an evolution of longstanding security principles centered on knowing assets, minimizing permissions, and controlling access rigorously. However, the human element remains the primary challenge—authorization and trust issues persist even as AI begins to replace human roles—while implementing Zero Trust can be complex and costly, with vendors capitalizing on these challenges, as noted in candid industry critiques.

Zero Trust is often misunderstood as merely identity management or a product category, but thought leaders like John Kervog clarify it is a strategic approach aimed at eliminating implicit trust and preventing breaches through continuous verification beyond authentication. This strategy requires robust policies and documented processes to align permissions strictly with roles and actual needs, emphasizing that while products support Zero Trust environments, no single product defines the concept.

By mid-2026, identity sprawl driven by the proliferation of AI agents and machine accounts has overwhelmed 89% of IT leaders, exposing critical security gaps exacerbated by disconnected security tools that hinder real-time detection of credential misuse, as reported by Keeper Security. This surge in non-human identities, coupled with concerns over inadvertent data exposure to AI systems—highlighted by 56% of organizations—underscores the urgent need for unified identity governance frameworks to enforce Zero Trust policies effectively, a point emphasized by Keeper Security CEO Darren Guccione who warns that 'every unmanaged identity is a prime target for attackers.'

The fragmentation of identities across disparate systems—from databases like MySQL to cloud platforms such as AWS—creates exploitable security gaps that attackers readily leverage, making a unified identity layer indispensable for comprehensive Zero Trust enforcement. As one expert noted in June 2026, consolidating identities of databases, machines, microservices, agents, and humans into a single cohesive layer is foundational for secure production environments; this shift also demands a transformation in organizational structures, with cybersecurity functions becoming more engineering-driven to manage the complex interplay of human and non-human identities.

Enterprises are hemorrhaging an estimated $46 billion annually due to outdated centralized identity graphs that not only violate data residency laws but also fail to meet the demands of a fractured global data privacy landscape. This financial and regulatory pressure is catalyzing a radical shift toward ephemeral token solutions that better uphold Zero Trust principles, regulatory compliance, and customer transparency, signaling a pivotal evolution in identity management strategies to address both security and legal imperatives.

Unified identity platforms, such as One Identity’s 'identity fabric,' which integrates Identity Governance and Administration (IGA), Privileged Access Management (PAM), access management, and Active Directory, are emerging as critical defenses against AI-driven threats and the explosion of Non-Human Identities (NHAs) that outnumber human identities by up to 80 to one in operational technology environments. This comprehensive approach not only mitigates sophisticated impersonation attacks—recently responsible for over $400 million in losses in Latin America—but also elevates identity governance to a board-level priority linked to financial stability and cyber insurance mandates. Leveraging native integration and automation, these platforms enable context-aware MFA, just-in-time privilege escalation, and immediate anomaly response without adding operational complexity, effectively closing security gaps exploited by cybercriminals.

By 2026, data sovereignty concerns have evolved from simple geographic data residency to a complex interplay of control, access, and regulatory compliance across hybrid and multi-cloud environments. This shift is exemplified by hyperscalers and regional data centers grappling with power constraints and cross-border regulations, where the distinction between data's physical location and its administrative control becomes critical. As one analyst noted, organizations have yet to rationalize the difference between data and its physical presence, especially when data must be accessed across multiple jurisdictions, highlighting the nuanced challenges of managing metadata versus actual data and whether it resides in memory or on disk.

Asia-Pacific's approach to data sovereignty often conflates physical data localization with true control, a misconception that has led to unintended vulnerabilities and economic drawbacks. The 2025 South Korean data center fire, which disrupted 647 government services and resulted in the loss of 850 terabytes of data due to lack of geographic redundancy, starkly illustrates the risks of strict localization mandates. Moreover, smaller SaaS companies in the region face disproportionate compliance burdens as they cannot afford local data centers, impeding innovation and competition. Regional initiatives like ASEAN’s Digital Economy Framework Agreement (DEFA) aim to harmonize data flow regulations to grow the digital economy from $300 billion to $2 trillion by 2030, but fragmented policies threaten these ambitions unless cross-border data flows are embraced with technical safeguards such as end-to-end encryption and customer-managed keys.

The European Union’s 2026 Technological Sovereignty Package, particularly the Cloud and AI Development Act (CADA), represents a strategic pivot to reduce dependency on American hyperscalers, who currently dominate 70% of the EU cloud market. This dominance is fraught with geopolitical tension, as US laws like the CLOUD Act compel data disclosure worldwide, clashing with GDPR and raising alarms after Microsoft admitted in 2025 that US authorities could access data stored in French data centers without French government consent. The EU’s sovereignty framework is not isolated but interlocks with regulations such as the EU Data Act, NIS2, DORA, and the AI Act, creating a complex compliance cascade that is driving a projected surge in sovereign cloud spending from $6.9 billion in 2025 to $23.1 billion by 2027.

India’s pursuit of data sovereignty underscores the paradox of territorial laws confronted by extraterritorial cloud regulations, notably the US CLOUD Act, which enables American authorities to access data stored within Indian borders if controlled by US-based cloud providers. Despite legislative advances like the Digital Personal Data Protection Act, 2023 and RBI’s data localization rules ensuring residency, full sovereignty remains elusive because control over encryption keys and administrative access often resides with foreign entities. This tension is especially acute in critical sectors such as financial services, where data protection is paramount. Consequently, sovereignty now transcends mere data residency, encompassing control over infrastructure, access rights, and policy portability across hybrid cloud environments, with enterprises demanding unified management planes to enforce consistent data policies amid the complexity introduced by AI workloads and distributed cloud architectures.

By mid-2026, it became clear that current sovereign cloud offerings, such as IBM's Sovereign Core and Microsoft's Azure Local, are largely marketing facades rather than true architectural solutions to data sovereignty. The Swiss federal sovereign cloud, essentially a rebranded Microsoft Azure, was even rejected by the Swiss military, underscoring that simply localizing foreign cloud software does not guarantee sovereignty, especially when these applications may harbor backdoors or kill switches controlled by external entities.

True data sovereignty transcends physical data localization and demands cloud architectures that are inherently multi-provider and multi-jurisdictional, governed by protocols rather than vendors. Innovations like mathematical network-based clouds employing Byzantine fault tolerance enable workload portability across providers such as Amazon datacenters without interruption, ensuring resilience against infrastructure failures and geopolitical risks. This paradigm shift moves sovereignty from a superficial wrapper to an embedded architectural property.

Despite enterprises paying a premium of 10% to 30% for sovereign cloud regions, much of this investment results in 'checkbox theater'—an illusion of compliance achieved by localizing data storage while critical components like control planes and identity access management remain centralized globally. Regulators focus on who can access data rather than its physical location, meaning that sovereignty must be architected into data flows, not just data rest, to withstand scrutiny and audits.

The Indian context exemplifies the limits of sovereign cloud solutions, where physical data localization does not equate to sovereignty due to extraterritorial laws like the US CLOUD Act and control over encryption keys by US-based hyperscalers—AWS, Microsoft Azure, and Google Cloud—who dominate over 60% of the market. Although India has achieved data residency and localization, true sovereignty remains elusive as foreign jurisdictions can compel access, highlighting the critical distinction between residency, localization, and sovereignty in cloud governance.

Operational strategies for managing data flows in hybrid cloud environments increasingly rely on a global infrastructure 'wrapper' that balances strict data localization with seamless global support, as highlighted in mid-2026 analyses. This approach enables organizations to comply with sovereignty laws while maintaining follow-the-sun support models through partnerships and joint ventures that blend global functionality with local expertise, ensuring 24/7 operational resilience. Martin Hosken further emphasizes that beyond mere data residency, the complexity of cross-border data flows—such as those traversing undersea cables—demands comprehensive visibility and control at every stage, integrating resilience as a foundational design principle to counter evolving cyber threats.

Emerging technologies like federated learning and confidential computing are reshaping operational strategies by enabling zero trust security and AI governance without centralized data aggregation, a critical advantage amid escalating techno-nationalist tensions and regulatory scrutiny. Hosken underscores that confidential computing, combined with post-quantum cryptography, underpins secure coalition cloud environments essential for cross-border intelligence sharing, while also preparing for future quantum threats that could decrypt today's encrypted data. This technological integration is pivotal for maintaining sovereignty and trust in hybrid cloud architectures.

The operational challenge of maintaining consistent visibility, control, and policy enforcement across diverse hybrid and multi-cloud environments is compounded by varying shared responsibility models and heterogeneous security tools, as seen in India’s cloud control battle. Analysts advocate for an abstraction or common management layer that translates data policies uniformly across private clouds, public clouds, Kubernetes, VMs, and edge systems, enabling policies to 'travel' with workloads. This modern workload portability extends beyond compute to encompass storage, identity and access management, observability, CI/CD, and network policies, addressing blurred control boundaries and sovereignty risks inherent in multi-environment deployments.

Despite the near inevitability of vendor lock-in in hybrid cloud strategies, defense sector leaders like Martin Hosken highlight the value of open source models, such as Red Hat’s, to maintain transparency and security while balancing legal frameworks and operational needs. This strategic choice supports resilience and sovereignty by avoiding overdependence on single providers, fostering trusted technology partnerships that can adapt to the complex demands of hybrid cloud data flow management.

By mid-2026, digital sovereignty has matured from a narrow focus on data location and compliance to a strategic, multifaceted capability encompassing control, resilience, and competitiveness across the entire digital stack. As highlighted at Davos 2026 and in WEF discussions on 'Digital Embassies for Sovereign AI,' the emphasis has shifted toward practical design challenges such as jurisdictional clarity, interoperability, and shared governance, enabling nations to maintain global connectivity while retaining control over data, compute, and legal frameworks. This evolution reflects a broader recognition that sovereignty is less about physical data residency and more about who ultimately governs the systems that process and generate value from data, including cloud infrastructure and AI models.

The emerging paradigm of 'strategic interdependence' replaces the outdated notion of technological decoupling, aiming to balance openness with deliberate management of critical dependencies to mitigate systemic risks. As articulated in recent WEF and Bain analyses, this approach acknowledges that full self-sufficiency is neither feasible nor desirable in a globally interconnected digital economy, especially as over half of EU enterprises (52.7%) adopted paid cloud services and 20% integrated AI technologies by 2025. This nuanced stance fosters collaboration while safeguarding national interests, positioning digital sovereignty as a competitive advantage rather than a barrier.

Federated learning is rapidly emerging as a transformative solution to reconcile global data privacy challenges with the demands of AI governance and zero trust security frameworks amid escalating techno-nationalist tensions. By enabling decentralized AI model training without centralized data pooling, this approach facilitates cross-border compliance and robust security, effectively addressing the complexities of managing sensitive data flows highlighted by experts like Martin Hosken. Hosken underscores that the critical challenge is no longer data location but the secure management of data in motion across international cables and cloud environments, especially within defence contexts where coalition cloud environments rely on cutting-edge technologies such as post-quantum cryptography and confidential computing to anticipate future quantum threats.

Resilience and governance have become foundational pillars of modern digital sovereignty, particularly within multinational defence alliances where sovereignty requirements vary widely. Martin Hosken emphasizes that resilience must be architected from the physical infrastructure up through applications and data architecture to balance availability against an expanding attack surface. Furthermore, technology providers like Red Hat play a crucial role by offering open, transparent, and secure platforms that adapt to evolving legal and operational demands, mitigating challenges such as vendor lock-in through open source models that ensure visibility and enterprise-grade security hardening. This comprehensive approach underscores that future digital sovereignty hinges on integrated control, adaptability, and collaborative governance rather than isolated technological silos.