South African organisations are under growing pressure to digitise, innovate and compete in a more connected economy. Yet every new cloud workload, SaaS application, and remote connection has the potential to expand the attack surface.
The consequences are becoming harder to ignore, with some of the costliest data breaches running into hundreds of millions of rands and almost half of South African organisations identifying cloud-related threats as a major concern.
The question is: how do enterprises accelerate digital transformation without expanding the attack surface faster than they can secure it? Traditional security models, built around clearly defined perimeters, were never designed for a world where users, applications and data exist everywhere at once.
Zero Trust emerged as the answer to this challenge. It replaces static, perimeter-based controls with continuous validation of every user, device, and session, wherever they operate. Yet while the principle is widely accepted, organisations are struggling to turn Zero Trust from a security strategy into an operational reality. And it’s not just local companies facing this predicament.
The Zero Trust execution gap
According to HPE’s 2026 Zero Trust Report, most organisations globally understand what Zero Trust requires but struggle to enforce it consistently across hybrid and multi-cloud environments. Based on a survey of over 850 IT, networking, and cybersecurity professionals, the report identified a 65-point gap between strategic intent and operational reality. While 82% of respondents believe Universal Zero Trust Network Access (ZTNA) is essential to their security strategy, only 17% have fully implemented it.
On average, organisations rate their Zero Trust effectiveness at just six out of ten. The challenge is not a lack of commitment. It is the growing complexity of securing users, devices, applications and data across increasingly distributed environments.
One in four organisations cite tool and vendor sprawl as their biggest barrier to advancing Zero Trust and SASE, ahead of budget, skills, or legacy systems. After years of layering point solutions to solve isolated problems, security teams now navigate a maze of overlapping controls that operate independently rather than cohesively. The result is reduced visibility and more opportunities for threats to exploit the gaps between systems.
Those gaps matter because they allow pockets of implicit trust to persist across the environment. Over-entitled user accounts, inconsistent SaaS permissions, and unmanaged devices continue to create pathways for attackers to blend into legitimate activity, not through sophisticated exploits but by taking advantage of complexity and inconsistency.
These are not failures of Zero Trust as a concept. Rather, they highlight a fundamental reality: effective verification depends on a simpler, more unified foundation for policy and enforcement.
Success starts with simplifying the architecture
This is where Secure Access Service Edge (SASE) becomes critical. Zero Trust defines the security outcome: continuous verification of every identity, device, and connection. SASE, in turn, provides an important architecture needed to deliver that outcome consistently across hybrid networks, cloud workloads and remote users.
By converging SD-WAN connectivity with cloud-delivered Security Service Edge capabilities, SASE enables organisations to enforce identity- and context-based policy wherever users and data operate. Instead of routinely backhauling all traffic through data centres, it directs it through more appropriate enforcement points and paths. Instead of tying policy to IP addresses, it follows identity. Instead of managing dozens of disconnected consoles, teams orchestrate a single security policy fabric that applies context-aware controls everywhere, from headquarters to home office, from private applications to SaaS environments.
The benefits extend well beyond efficiency. Unified architecture reduces friction between networking and security teams, establishing a single source of policy truth and making change easier to manage across sites, clouds and remote users. Visibility and consistency improve. Automation reduces human error. And, most importantly, organisations gain the foundation required to make Zero Trust operational.
Unifying enforcement across connections
Once the architecture is unified, enforcement must follow. That’s where Universal Zero Trust Network Access becomes the operational core of a modern security fabric.
Unlike traditional ZTNA, HPE’s Universal ZTNA fills a critical gap in today’s SASE framework by extending Zero Trust beyond remote users to campus and branch networks. By combining unified SASE with identity, device visibility and Network Access Control (NAC), it applies a single identity- and context-based policy across remote, branch and on-site environments, eliminating the fragmentation of separate access systems.
Once organisations establish a unified approach to access and policy enforcement, the next stage of maturity is about extending those same principles consistently across users, devices, data and workloads.
In mature programmes, there is a clear evolution from defending the perimeter to securing the entire transaction chain, from authentication through to data access. Identity establishes who connects, device posture confirms trustworthiness, data controls govern what can be accessed, and threat detection validates behaviour in real time. Together, these controls form a continuous trust loop: one policy framework, many enforcement points.
Amplifying Zero Trust with intelligence
As organisations extend Zero Trust across the enterprise, the challenge shifts from policy enforcement to operating that security fabric at scale. This is where artificial intelligence (AI) can become a force multiplier, analysing telemetry across the environment, helping identify anomalies more quickly than human teams can and adapting protections based on real-time context.
In mature environments, AI does not replace human judgement. Instead, it augments security teams through intelligent copilots that automate routine tasks, surface meaningful insights, and recommend actions as threats emerge. The result is a more adaptive security model, one that helps teams to respond more quickly and apply protections more consistently across enforcement points.
When simplification, unified enforcement and intelligence come together, Zero Trust evolves from a collection of security initiatives into a cohesive, adaptive defence model where continuous verification becomes operational, not aspirational. For South African organisations navigating rapid digital transformation, the greatest gains will come from reducing complexity, applying policy consistently, and using intelligence to strengthen every decision. This creates a security fabric that can scale with the business while turning resilience and trust into genuine competitive advantage.
By Mandy Duncan, Country Manager, HPE Networking South Africa