AI-Enhanced Zero Trust

Zero trust is not a product. NIST SP 800-207 defines it as a set of tenets: no implicit trust based on network location, access granted per session, decisions driven by dynamic policy that weighs identity, device state and behavioral attributes, and continuous monitoring of every asset. The CISA Zero Trust Maturity Model v2.0 organizes the same idea into five pillars (identity, devices, networks, applications and workloads, data) with four maturity stages from Traditional to Optimal.

Notice what sits at the center of NIST's design: a policy engine running a "trust algorithm". That is exactly where AI plugs in. But a trust algorithm can only reason about identities you have inventoried, devices you can see and logs you actually collect.

The Canadian Centre for Cyber Security puts the starting line in plain language: enforce strong MFA (it recommends aiming for Level of Assurance 3); base access on user and device information rather than location; use just-in-time, just-enough access; and use dedicated workstations for admin work. None of that needs machine learning.

The threat data explains why identity comes first. In the 2026 Verizon DBIR, credential abuse appeared at some point in 39% of breaches in the dataset, even though vulnerability exploitation overtook it as the top initial access vector. Breaches with third-party involvement rose 60% to 48% of the total. Stolen logins and over-trusted partners are an identity problem before they are an AI problem.

Across our assessments, three uses of AI consistently earn their place in a 30 to 200 person SaaS company.

This is the most mature use. The identity provider scores each sign-in on signals like impossible travel, a new device, an anonymizing network or a leaked credential, then triggers step-up MFA or blocks the session. The value is not the score itself. It is that a risky admin sign-in at 3 a.m. gets challenged instead of waved through because the password was correct. Most mid-market identity platforms include some form of this in their higher license tiers, so check what you already own before you buy anything new.

Behavioral baselines work well on a small, high-value population: admins, engineers with production access, and service accounts. A support agent who suddenly exports 40,000 customer records, or a CI/CD token calling an API it has never touched, is the kind of deviation NIST describes as "measured deviations from observed usage patterns". The model flags it; a human decides.

The quietest win. AI-assisted analysis of who actually uses which permissions makes quarterly access reviews faster and turns "remove standing privilege" from a slogan into a list of specific grants to revoke. It also supports the continuous access monitoring evidence that SOC 2 and ISO 27001 auditors ask for.

There is also a measurable payoff in incident response. IBM's 2026 Cost of a Data Breach report found that organizations using security AI and automation saved an average of $1.93 million per breach, against a record global average breach cost of $4.99 million.

This is the table I draw on the whiteboard when a founder shows me a vendor deck. Vendors will dispute the right-hand column. I stand by it.

A useful test: ask the vendor which NIST SP 800-207 component their product implements (policy engine, policy administrator or policy enforcement point) and which CISA pillar and maturity stage it moves you to. Vague answers tell you what you need to know.

NIST SP 1800-35, finalized in June 2025, demonstrated 19 example zero trust implementations built with 24 technology collaborators. If the reference build needed that many components, no single AI product is your whole architecture.

Here is the part most zero trust programs miss. Your SaaS company probably now has more non-human identities than employees: API keys, OAuth grants, service accounts, CI/CD tokens and, increasingly, AI agents that read email, query databases and open tickets on someone's behalf.

An AI agent is an identity with delegated authority. Treat it exactly that way. The OWASP Top 10 for Agentic Applications 2026 lists "identity and privilege abuse" (ASI03) as a top risk: agents exploiting delegated trust, inherited credentials or role chains. NIST's NCCoE published a concept paper on software and AI agent identity and authorization in February 2026, which tells you the standards are still forming. Do not wait for them.

Apply the same tenets you apply to people:

We cover agent controls in more depth in how to secure AI agents, and the governance side sits within our AI governance practice.

Honesty saves budget here. Skip the AI layer for now if any of these are true:

What AI-enhanced zero trust does not stop: a fully legitimate insider doing something harmful within their normal pattern, a compromised vendor operating inside its granted scope, or an unpatched public-facing system. Those need least privilege, vendor risk management and patching. Revisit the AI layer when you add an external API surface, contractors with production access, or a SOC 2 or ISO 27001 commitment that requires evidence of continuous access monitoring.

Sequence matters more than tooling. This is the order I use as a virtual CISO:

Days 1 to 30: see everything. Inventory human and non-human identities, including AI agents and OAuth grants. Enforce phishing-resistant MFA on admins first, then everyone. Turn on and centralize identity provider and cloud audit logs. Run a CIS Controls gap assessment; CIS Controls 5 and 6 cover account and access control management.

Days 31 to 60: shrink trust. Remove standing admin rights in favor of just-in-time elevation. Rotate long-lived keys and replace shared secrets. Switch on identity risk scoring and step-up MFA in the license you already pay for. Write a one-page access policy that a model can later enforce.

Days 61 to 90: add intelligence where it pays. Apply anomaly detection to admins, production access and service accounts only. Put AI agents behind scoped identities with approval gates. Track three numbers: risky sign-ins challenged, standing privileges removed, and time to revoke a compromised identity. Map progress to the CISA maturity stages for your board and for the next security questionnaire.

Short version: inventory, then least privilege, then AI.

No. NIST SP 800-207 and the CISA maturity model describe zero trust without requiring machine learning. AI improves the quality and speed of access decisions once identity, device and logging basics are in place.

Identity risk scoring with step-up MFA at sign-in. It is usually included in your identity provider's higher tiers, needs little tuning, and protects against the credential abuse that still shows up in nearly four in ten breaches.

Yes. Each agent should have a unique identity, task-scoped permissions, short-lived credentials and full logging. Agents that borrow a human's account break attribution and make least privilege impossible to enforce.

For a 30 to 200 person SaaS company, the foundation plus initial AI controls fits in about 90 days. Reaching CISA "Advanced" across all five pillars is a multi-quarter program.

Back to that CTO. She did not buy either platform. In 90 days her team inventoried every identity, removed standing admin access, switched on risk-based sign-in she was already licensed for, and gave her two AI agents their own scoped identities. Question 41 now has a credible answer.

If you want an outside view of where your zero trust program stands, our vCISO cost guide and pricing page show what an engagement looks like, and you can book a consultation to walk through your identity inventory with me.