Zero Trust Statistics 2026: Adoption, Maturity and Gaps

Zero trust statistics for 2026 show a strategy that most organizations have started and few have finished. In Gartner's survey of 303 security leaders, 63% had fully or partially implemented a zero-trust strategy, but for most it covered half or less of their environment. Gartner predicted that only 10% of large enterprises would have a mature, measurable program by 2026. Among US federal agencies, CISA found that 89% of those reporting had not said how they would combine automated and manual application testing. Here are the verified zero trust statistics and how to test the controls behind them.

Zero trust statistics at a glance

Every figure below was checked on the publisher's own page, report or filing on 5 November 2026. Forecasts and vendor research are labeled. Read the "What it measures" column before comparing two rows.

Primary sources for each row are linked in the sections below and listed under Sources and References.

Five kinds of evidence sit in this table, and they should not be blended:

• Government mandates and metrics (OMB, CISA, DoD) set deadlines and report measured federal progress. They are the most reliable numbers, but they describe government only.
• Analyst surveys (Gartner) describe a sample of security leaders, not every organization.
• Analyst forecasts (Gartner predictions) are opinions about the future, and some of their target dates have now arrived.
• Vendor surveys (Okta, Zscaler) are useful but come from companies that sell zero trust products.
• Breach and research data (Verizon, Microsoft) show which attack paths succeed, which is what zero trust controls are meant to close.

None of these numbers adds up to a single "zero trust adoption rate."

What zero trust means, according to NIST and CISA

NIST SP 800-207, published in August 2020, defines zero trust as a set of cybersecurity paradigms that move defenses "from static, network-based perimeters to focus on users, assets, and resources." A zero trust architecture grants no implicit trust based on network location or asset ownership. Users and devices are authenticated and authorized before each session to a resource.

CISA's Zero Trust Maturity Model turns that principle into a roadmap. Version 2.0, released in April 2023 and aligned to OMB M-22-09, has:

• Five pillars: Identity, Devices, Networks, Applications and Workloads, and Data.
• Three cross-cutting capabilities: Visibility and Analytics, Automation and Orchestration, and Governance.
• Four maturity stages: Traditional, Initial, Advanced and Optimal.

The Department of Defense uses a seven-pillar model instead, adding visibility and analytics and automation and orchestration as pillars of their own. Gartner's working definition is shorter: zero trust explicitly identifies users and devices and grants them "just the right amount of access."

In practice, that means zero trust is a set of claims about access: who can reach what, from which device, under which conditions. Statistics about zero trust measure whether organizations have made those claims. Testing measures whether the claims hold.

Zero trust frameworks and deadlines at a glance

Sources: OMB M-22-09, the CISA maturity model page, the DoD release, the NIST SP 1800-35 page and the CISA reports cited below. CISA's FY 2024 report dates maturity model 2.0 to April 2023.

How many organizations have adopted zero trust?

Gartner: 63% have started, usually on part of the environment

Gartner surveyed 303 security leaders in the fourth quarter of 2023, all from organizations that had implemented zero trust or planned to. Its 22 April 2024 release reported:

• 63% of organizations worldwide had fully or partially implemented a zero-trust strategy.
• For 78% of implementers, zero trust accounted for less than 25% of the cybersecurity budget.
• 56% pursued zero trust mainly because it is cited as an industry best practice.
• 16% expected their strategy to cover 75% or more of the environment, while 11% expected it to cover less than 10%.

Because the sample excluded organizations with no zero trust plans, read 63% as a share of interested organizations, not of all companies.

Okta: 61% with a defined initiative (vendor survey)

Okta, an identity vendor, surveyed 860 information security decision makers in 13 countries in April 2023, through Qualtrics. Its State of Zero Trust Security 2023 report found:

• 61% of organizations had a defined zero trust initiative in place, up from 55% in 2022 and 24% in 2021. That is about 2.5 times the 2021 level (61 divided by 24; our calculation).
• Another 28% planned one within 6 to 12 months, and 7% within 13 to 18 months.
• North America led at 73%, and financial services led the industries Okta focused on, at 71%.

Zscaler: VPN replacement drives plans (vendor survey)

Zscaler, which sells zero trust access products, commissioned Cybersecurity Insiders to survey more than 600 IT and security professionals. The ThreatLabz 2025 VPN Risk Report, released on 10 April 2025, found:

• 81% of organizations planned to implement zero trust within the next 12 months.
• 65% planned to replace their VPN within the year.
• 92% were concerned that unpatched VPN vulnerabilities would lead to ransomware, and 93% worried about backdoors through third-party VPN connections.

Taken together, the surveys agree that most mid-size and large organizations have a zero trust initiative or a plan for one. They do not show how much of each environment is covered, and that is where the numbers drop.

How mature are zero trust programs?

Adoption and maturity are different questions. In January 2023, Gartner predicted that by 2026 only 10% of large enterprises would have a mature and measurable zero-trust program, up from less than 1% at the time. This is a forecast. Gartner has not published a 2026 measurement against it, so treat it as an expert estimate of how rare maturity is, not a count.

Gartner's 2024 survey supports the direction of that forecast. Gartner's analysts summarized that, for most organizations, zero trust "typically addresses half or less" of the environment and mitigates one-quarter or less of overall enterprise risk. The same survey shows where programs struggle:

• 35% of organizations had encountered a failure that disrupted their zero trust implementation.
• 62% expected zero trust to increase costs, and 41% expected it to increase staffing needs.
• 79% of implementers had strategic metrics to measure progress, and 89% of those had metrics for risk.
• 59% of zero trust initiatives were sponsored by the CIO, the CEO or president, or the board.

Gartner also warned that, through 2026, more than half of cyberattacks would be aimed at areas that zero-trust controls do not cover and cannot mitigate, such as public-facing APIs and social engineering. Its recommendation was to pair zero trust with a continuous threat exposure management (CTEM) program for everything outside the zero trust scope.

Federal zero trust: deadlines and measured progress

The US federal government is the only large population with public, repeated zero trust measurements. That makes it the best benchmark available, even for private organizations.

What OMB M-22-09 required

OMB issued M-22-09 on 26 January 2022, following Executive Order 14028 of May 2021. It set these deadlines for federal civilian agencies:

• Within 30 days: designate a zero trust strategy implementation lead.
• Within 60 days: submit an implementation plan for FY 2022 to FY 2024 and a budget estimate for FY 2024.
• By September 2022: welcome external vulnerability reports for internet-accessible systems.
• Within one year: make at least one internal FISMA Moderate system that requires authentication fully usable over the internet.
• By the end of FY 2024 (30 September 2024): meet the strategy's goals across all five pillars, including phishing-resistant MFA for staff, contractors and partners.

The applications pillar is the one most relevant to testing. M-22-09 required agencies to run dedicated application security testing programs, to use "high-quality firms specializing in application security for independent third-party evaluation," and to use both automated tools and manual expert analysis when authorizing systems. It noted that running a scanner against a web form "would not provide confidence in the security of that form."

FY 2024: measured progress in identity, devices and networks

CISA's first zero trust report to Congress, dated 29 January 2025, reviewed 70 agency implementation plans (24 CFO Act agencies and 46 others) together with FISMA and CDM data from FY 2022 to FY 2024:

• The share of agencies with more than 90% hardware asset coverage rose from 33% to 55%, and for software coverage from 18% to 39%.
• "Unknown or uncategorized" device types fell from 55% in Q1 FY 2023 to just under 5% in Q3 FY 2024.
• 99 agencies were using endpoint detection and response (EDR) tools that meet CISA requirements.
• 92% of agencies had onboarded to CISA's Protective DNS, covering more than 99% of federal external DNS traffic.
• 51 agencies had onboarded to CISA's vulnerability disclosure platform, and 47 ran their own programs.
• CISA's Federal Attack Surface Testing team had brought 26 agencies into continuous penetration testing of internet-facing assets.

CISA found agencies at lower maturity in the applications pillar than in identity, devices or networks, and said they lacked the staff for "more comprehensive automated and manual application security testing."

FY 2025: where agencies still lag, by pillar

CISA's second report to Congress, dated 31 August 2026, analyzed updated implementation plans from 56 agencies, a 55% submission rate: every CFO Act agency, but only 42% of the others. Measured progress continued:

• Phishing-resistant MFA implementation rose from 71% to 75%, and compliance from 80% to 83%.
• Nearly 60% of agencies reached 90% asset coverage, and EDR covered 80% of government-furnished endpoints.
• 96% of agencies used Protective DNS, and data encryption reached 92% in transit and 93% at rest.

The plans themselves show where zero trust is thinnest. The table below lists the largest gaps CISA reported among the 56 reporting agencies.

Two patterns stand out. First, the pillars that rely on products, such as DNS, EDR and MFA, moved fastest. CISA's FY 2024 report said agencies "made the least progress in areas that require new capabilities rather than off-the-shelf solutions." Second, the most widespread gap is not a missing product. It is the lack of a plan to test applications, both automatically and manually. That is the control M-22-09 singled out, and the one that tells an agency whether its other controls work.

The share of websites enforcing HTTPS also slipped from 92% to 91%, a reminder that zero trust coverage can go backward without continuous checks.

The Department of Defense target: FY 2027

The DoD released its Zero Trust Strategy and Roadmap on 22 November 2022. Its capability execution roadmap breaks zero trust into:

• 7 pillars and 45 capabilities;
• 152 activities in total, of which 91 make up "Target Level" zero trust and 61 the "Advanced" level;
• a deadline to reach Target Level across the department by the end of FY 2027 (30 September 2027).

The DoD framed Target Level as the minimum needed to stop an adversary from moving laterally once inside, or from getting past the perimeter in the first place. Public, department-wide progress figures against the 91 activities were not available at the time of writing.

Does zero trust stop breaches? What the breach data shows

Zero trust is designed to remove implicit trust, so the best way to judge its relevance is to look at how breaches begin.

• Exploitation now leads. The Verizon 2026 DBIR, covering more than 22,000 confirmed breaches from October 2024 to November 2025, found that vulnerability exploitation was the initial access vector in 31% of breaches. Credential abuse, the previous leader, fell to 13%. Exploitation is now about 2.4 times as common as credential abuse (31 divided by 13; our calculation). Our vulnerability statistics cover patching data in more depth.
• Patching is slipping. Only 26% of critical vulnerabilities in CISA's Known Exploited Vulnerabilities catalog were fully remediated in 2025, down from 38%, and the median time to full resolution rose to 43 days.
• Third parties are inside the perimeter. Breaches involving a third party reached 48%, up 60% from the prior year. Only 23% of third-party organizations fully remediated missing or weak MFA on their cloud accounts.
• People are still a factor. The human element was present in 62% of breaches.

These numbers cut both ways. Identity controls work: a Microsoft research study of Microsoft Entra accounts found that MFA reduced the risk of compromise by 99.22%, and by 98.56% when credentials had already leaked. But attackers are shifting to exposed, unpatched services and to partners, which are exactly the areas Gartner warned zero trust programs often leave out of scope. Our compromised credential statistics track the identity side of that shift, and our guide to MFA fatigue attacks shows why only phishing-resistant MFA closes it.

Is there a cost benefit? The most quoted figure is old. IBM's 2021 Cost of a Data Breach study found that organizations with a mature zero trust strategy averaged USD 3.28 million per breach, USD 1.76 million less than organizations that had not deployed zero trust at all. Those breaches occurred between May 2020 and March 2021, and later editions have not repeated the comparison. Use it as historical context, not as a 2026 benchmark.

Where zero trust implementations fail and what testing validates

The statistics point to the same failure points across surveys and federal data. The table maps each pillar to how implementations commonly fail and what a penetration test should validate. It is DeepStrike method guidance, not data from the cited studies.

The table is deliberately about access paths rather than products. A zero trust architecture can have every component in place and still fail at a single exception: a service account excluded from MFA, a legacy application reachable from a flat segment, or an API that checks authentication but not authorization. Our guide to lateral movement explains how attackers use those exceptions after the first foothold.

How to validate zero trust controls: a six-step plan

Zero trust maturity models describe what to build. This sequence shows whether it works. It is DeepStrike method guidance, not a requirement from NIST, CISA or OMB, and all testing must be authorized and scoped in writing.

1. Define the protect surface. List the critical applications, data and identities your zero trust program covers, and the exceptions it does not. Output: a scope that matches the program's real coverage, not its diagram.
2. Test identity controls. Check MFA coverage on every in-scope application, including fallback methods, legacy protocols, service accounts and session lifetimes. Output: a list of paths that reach resources without phishing-resistant MFA.
3. Test from the outside. Run an external penetration test of internet-facing services, especially VPNs, remote access gateways and applications published without a VPN. Output: validated findings on the exposures Verizon now ranks first.
4. Assume a breach and measure the blast radius. Run an internal penetration test that starts from one standard user account and one managed device. Output: how far segmentation and least privilege actually stop movement.
5. Test applications and data access manually. Test authentication, authorization and data exposure in each critical application, and in cloud tenants through cloud penetration testing. Output: application findings that a scanner would miss, which is the gap M-22-09 described.
6. Retest, measure and repeat. Retest fixed findings, record which policy decisions the security team detected, and repeat after major changes. Output: evidence you can map to maturity model stages and report as a zero trust metric.

For hybrid and remote workforces, our remote work cybersecurity statistics show why access paths outside the office deserve the same scrutiny.

How we compiled these zero trust statistics

Selection. We included a statistic only if we could read it on the original publisher's page, report or filing and record its date, sample and method. We prioritized:

• government mandates, reports and standards (OMB, CISA, DoD, NIST)
• analyst surveys and predictions from Gartner's own press releases
• breach and research data with published methods (Verizon, Microsoft Research, IBM)

We then used vendor surveys with published scope (Okta, Zscaler) and labeled each as vendor research. Gartner predictions are labeled as forecasts.

Exclusions. We excluded zero trust market-size figures, because the numbers that circulate come from market-research resellers without a traceable method and vary widely. We also excluded industry-by-industry adoption rates that appear on vendor blogs without a named study, and statistics we could only find quoted second-hand.

Report years. Report titles carry the publication year, not the year of the data. Verizon's 2026 DBIR covers breaches from October 2024 to November 2025. Gartner's 2024 release reports a survey from the fourth quarter of 2023. CISA's FY 2025 report, dated 31 August 2026, relies on plans submitted under OMB M-24-14 and interviews held from December 2024 to March 2025.

Calculations. Two derived figures appear on this page:

• Okta's share of organizations with a defined initiative rose about 2.5 times between 2021 and 2023: 61 divided by 24.
• In the Verizon 2026 DBIR, exploitation was about 2.4 times as common as credential abuse as an initial access vector: 31 divided by 13.

All other numbers are quoted as published.

Limits. No source gives a representative count of organizations with mature zero trust, and none is claimed here. Survey samples are drawn from organizations interested in zero trust, which inflates adoption rates. Federal data covers US government agencies only, and the FY 2025 figures describe only the agencies that submitted plans.

Frequently asked questions

What percentage of organizations have implemented zero trust?

In Gartner's survey of 303 security leaders in late 2023, 63% said their organization had fully or partially implemented a zero-trust strategy. Okta's 2023 vendor survey of 860 decision makers found 61% with a defined zero trust initiative. Both samples lean toward organizations already interested in zero trust, and most programs cover only part of the environment.

How many companies have a mature zero trust program?

Very few. In January 2023, Gartner predicted that only 10% of large enterprises would have a mature and measurable zero-trust program by 2026, up from less than 1% at the time. That is a forecast, not a measurement. Gartner's 2024 survey found that zero trust usually covers half or less of an organization's environment.

What are the five pillars of zero trust?

CISA's Zero Trust Maturity Model 2.0 uses five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Three cross-cutting capabilities run across them: Visibility and Analytics, Automation and Orchestration, and Governance. The Department of Defense uses a seven-pillar model.

What was the federal zero trust deadline?

OMB memorandum M-22-09, issued on 26 January 2022, required federal civilian agencies to meet specific zero trust goals by the end of fiscal year 2024, which was 30 September 2024. The Department of Defense set its own deadline: Target Level zero trust by the end of FY 2027.

Did federal agencies meet their zero trust goals?

Partly. CISA's FY 2025 report to Congress, dated 31 August 2026, shows strong progress in identity, devices and networks, with phishing-resistant MFA implementation at 75% and Protective DNS at 96% of agencies. But 89% of reporting agencies had not said how they would combine automated and manual application testing, and most lacked clear plans for data categorization and logging.

Does zero trust prevent data breaches?

It reduces risk but does not eliminate it. Strong identity controls are effective: a Microsoft study found MFA cut the risk of account compromise by 99.22%. But the Verizon 2026 DBIR found that vulnerability exploitation, not credential abuse, now starts most breaches with a known initial access vector, and Gartner expected more than half of attacks through 2026 to target areas zero trust does not cover.

How do you test a zero trust architecture?

Test the access claims rather than the products. That means checking MFA coverage and fallbacks, whether device posture is enforced, how far one compromised account can move, whether each application enforces authorization, and what a low-privilege user can reach. OMB M-22-09 requires federal agencies to combine automated tools with manual expert testing, and independent third-party evaluation, for exactly this reason.

Next steps

The numbers agree on three things. Most organizations have started zero trust. Few have extended it across their whole environment or can measure it. And the weakest area, in both private surveys and federal data, is proof: testing that shows the controls hold when someone tries to get around them.

DeepStrike does not sell zero trust products. We test them. Our penetration testing services cover the access paths a zero trust program depends on:

• External and internal infrastructure testing: exposed services, VPN and remote access, segmentation and lateral movement.
• Web, API, mobile and cloud testing: authentication, authorization and data exposure in each application and tenant.
• Red team engagements and social engineering: whether people and detection controls hold up against a realistic attacker.

Every engagement is manual, and reports include remediation guidance and a technical presentation for your team. If you want evidence that your zero trust controls work, talk to DeepStrike about scoping a test.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• NIST, SP 800-207, Zero Trust Architecture (August 2020): https://csrc.nist.gov/pubs/sp/800/207/final
• NIST, SP 1800-35, Implementing a Zero Trust Architecture (June 2025): https://csrc.nist.gov/pubs/sp/1800/35/final
• NIST NCCoE, "NIST Publishes Final Special Publication 1800-35" (11 June 2025): https://www.nccoe.nist.gov/news-insights/nist-publishes-final-special-publication-1800-35-implementing-zero-trust-architecture
• CISA, Zero Trust Maturity Model: https://www.cisa.gov/zero-trust-maturity-model
• OMB, M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles (26 January 2022): https://bidenwhitehouse.archives.gov/wp-content/uploads/2022/01/M-22-09.pdf
• CISA, Zero Trust Architecture Implementation, FY 2024 Report to Congress (29 January 2025): https://www.dhs.gov/sites/default/files/2025-04/2025_0129_cisa_zero_trust_architecture_implementation.pdf
• CISA, Zero Trust Architecture Implementation, FY 2025 Report to Congress (31 August 2026): https://www.dhs.gov/sites/default/files/2026-10/26_0831_cisa_zero-trust-architecture_fy-2025.pdf
• US Department of Defense, "Department of Defense Releases Zero Trust Strategy and Roadmap" (22 November 2022): https://www.defense.gov/News/Releases/Release/Article/3225919/department-of-defense-releases-zero-trust-strategy-and-roadmap/
• DoD CIO, Zero Trust Capability Execution Roadmap (15 November 2022): https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-ZTExecutionRoadmap.pdf
• Gartner, "Gartner Survey Reveals 63% of Organizations Worldwide Have Implemented a Zero-Trust Strategy" (22 April 2024): https://www.gartner.com/en/newsroom/press-releases/2024-04-22-gartner-survey-reveals-63-percent-of-organizations-worldwide-have-implemented-a-zero-trust-strategy
• Gartner, "Gartner Predicts 10% of Large Enterprises Will Have a Mature and Measurable Zero-Trust Program in Place by 2026" (23 January 2023): https://www.gartner.com/en/newsroom/press-releases/2023-01-23-gartner-predicts-10-percent-of-large-enterprises-will-have-a-mature-and-measurable-zero-trust-program-in-place-by-2026
• Okta, The State of Zero Trust Security 2023: https://www.okta.com/reports/state-of-zero-trust/
• Zscaler, ThreatLabz 2025 VPN Risk Report release (10 April 2025): https://www.zscaler.com/press/zscaler-threatlabz-2025-vpn-risk-report-over-half-organizations-say-security-and-compliance
• Verizon, 2026 Data Breach Investigations Report, executive summary: https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf
• Meyer et al., "How effective is multifactor authentication at deterring cyberattacks?" (Microsoft, May 2023): https://arxiv.org/abs/2305.00945
• IBM, "IBM Report: Cost of a Data Breach Hits Record High During Pandemic" (28 July 2021): https://newsroom.ibm.com/2021-07-28-IBM-Report-Cost-of-a-Data-Breach-Hits-Record-High-During-Pandemic