- 01Real device trust requires four things: strong device identity (managed certificate or attested platform key), live posture signal (disk encryption, OS patch level, EDR healthy), real-time freshness (not yesterday's snapshot), and consumption at the access point (not just a dashboard).
- 02Identity-only Zero Trust is single-factor wearing two coats. Pin every access decision to device posture or accept that a stolen credential is a complete bypass.
- 03BYOD honestly: containerize, attest, and posture-check corporate apps; leave personal apps alone. Trying to enforce 'corporate device posture' on personal hardware causes user revolt and weakens the controls that matter.
- 04Device posture must land in the IdP risk engine and the ZTNA policy engine — not just EDR. Most modern IdPs accept MDM/EDR posture signals; wire the flows even if your initial policies are permissive. The plumbing is the work.
A great deal of Zero Trust spend has gone into identity providers, MFA, and ZTNA. Device trust — the assurance that the endpoint making a request is managed, healthy, and conformant — has often lagged. The result is access decisions that are largely identity-only, decorated with TLS.
What 'device trust' really requires
- 01Strong device identity — managed certificate or attested platform key
- 02Posture signal — disk encryption, OS patch level, EDR present and healthy
- 03Real-time signal — not yesterday's snapshot
- 04Consumption — at the access point, not in a dashboard
BYOD honestly
BYOD complicates device trust. The defensible path is a per-app or per-resource decision: corporate apps containerized, attested, and posture-checked; personal apps unrestricted. Trying to enforce 'corporate device posture' on personal hardware leads to user revolt and weakened controls.
Where to put the signal
Device posture should land in the IdP's risk engine and in the ZTNA policy engine — not just in EDR. Most modern IdPs accept posture signals from MDM/EDR; wire those flows even if your initial policies are permissive. The plumbing is the work.