Zero Trust FAQ: Extending Zero Trust to IoT and OT Devices

Zero Trust programs typically start with users and managed endpoints, where identities are validated frequently and permissions are kept minimal and short-lived. Organizations then face a tougher question: how to handle devices that cannot log in, run an agent, or authenticate like a laptop. Internet of Things (IoT) and operational technology (OT) devices make up a large share of networks, and a Zero Trust framework that excludes them leaves implicit trust in place for sensitive assets.

The answers below address common questions security leaders ask when extending Zero Trust to connected devices, including Internet of Medical Things (IoMT) equipment. Each answer stands on its own so teams can go directly to specific topics.

Zero Trust for Connected Devices

What Is Zero Trust for IoT and OT?

Zero Trust for IoT and OT applies the rule that no asset gets network access based solely on its location. It involves identifying every device, granting temporary minimal access, enforcing network policy, and adjusting access as risk or behavior changes.

NIST SP 800-207 defines Zero Trust using per-session access decisions based on dynamic policies and asset health. Without user credentials or software agents, device health is determined from network observations: identity, firmware version, vulnerabilities, and baseline activity.

Because OT access decisions should not disrupt operations, policies need validation before enforcement, and responses must remain proportionate.

Asimily extends Zero Trust to IoT, OT, IoMT, and IT assets by providing agentless identity and risk context and converting that context into enforced policies through Segmentation Orchestration.

[Related: Zero Trust]

How Do I Achieve Zero Trust for IoT?

Achieving Zero Trust generally follows a clear sequence: discover and classify devices, enrich device data beyond IP and MAC addresses, evaluate risk in context, define least-privilege rules, validate rules against traffic, enforce through Network Access Control (NAC) or firewalls, and maintain policy.

Each step builds on the previous one. Incomplete classification leads to incorrect access, enforcement without testing can cause outages, and unmaintained rules drift back toward implicit trust.

Organizations often start with higher-risk asset groups, such as large camera fleets or high-impact building controllers. This delivers early value and establishes a repeatable deployment method.

Asimily automates this lifecycle across IoT, OT, IoMT, and IT assets, covering high-fidelity discovery with detailed asset data, ATT&CK Analysis, Policy Auto-Recommendation, Policy Simulation, Policy Application, and Continuous Segmentation. It supplies the technology for the connected device portion of a Zero Trust strategy, alongside the process and procedural work that is also essential to success.

[Related: How Security and Network Teams Can Work Together to Achieve Zero Trust]

What Role Does Device Identity Play in Zero Trust?

Device identity is essential to Zero Trust. For agentless devices, identity depends on classification details: type, vendor, model, firmware, role, and normal activity gathered from network traffic and connected systems.

Limited identity detail restricts enforcement. A NAC that relies only on MAC addresses or broad categories applies overly generic policies and can grant access to spoofed addresses. IP addresses are also an unreliable anchor, since DHCP reassigns them regularly for at least some assets in most organizations.

Asimily classifies IoT, OT, IoMT, and IT assets down to model and firmware details, integrates data across NAC, CMDB, DHCP, and scanners, and shares identity and risk context with NAC platforms for enforcement.

[Related: What Is Identity-Based Microsegmentation?]

How Does Zero Trust Apply to Devices That Can’t Authenticate With 802.1X?

Devices that lack 802.1X support often rely on MAC Authentication Bypass (MAB). Zero Trust strengthens MAB by pairing MAC addresses with detailed classification and restricting devices to least-privilege access to limit spoofing risks.

Replacing legacy devices is frequently impractical. Because basic MAB trusts any approved MAC address, attackers who copy a legitimate address can gain network entry.

Two key measures help reduce this risk: behavioral profiling to catch unusual communication, and least-privilege rules to restrict movement (for example, limiting cameras strictly to video systems).

Asimily provides classification and behavioral context to verify MAB devices, flag unusual activity, and create least-privilege rules in native NAC formats.

[Related: Reduce Risk Faster with Asimily & Your NAC]

Enforcing Zero Trust

How Does Least Privilege Apply to IoT and OT Devices?

The established cybersecurity principle of least privilege requires that each device access only the systems, ports, and protocols it needs. Because connected devices usually follow predictable communication patterns, setting least-privilege rules is often simpler once traffic flows are mapped.

Defining rules starts with observed traffic. Restricting a controller or HMI strictly to its required servers and protocols eliminates unnecessary paths that attackers could exploit.

Rules should also account for risk state. Devices with known vulnerabilities may require tighter restrictions, such as limiting management access to a single host. Each organization will need to weigh security against convenient access when applying Zero Trust.

Asimily builds least-privilege rules for IoT, OT, IoMT, and IT assets based on observed traffic and ATT&CK Analysis, and formats them for native enforcement on NACs and firewalls. Before enforcement, Policy Simulation previews each rule’s impact against real, observed traffic. Asimily supports a broad set of networking vendors, including Cisco, Aruba, Arista, Extreme, and others.

[Related: Microsegmentation FAQ: Tools, Zero Trust, and Segmenting IoT and OT Devices Without Disruption]

How Do I Enforce Zero Trust on Devices That Cannot Host an Agent?

For agentless devices, Zero Trust is enforced at the network level. NACs manage access at connection points, and firewalls control inter-zone traffic. The harder problem is agentless identity and risk analysis, which determines whether policies are accurate and safe enough to enforce without interrupting operations.

Without software agents, device health must be evaluated externally using firmware vulnerability checks, behavior profiling, and non-disruptive network queries. Threat detection matters for these assets because no Zero Trust implementation fully prevents exploitation.

Network enforcement points are common, but manually creating and updating policies for thousands of agentless devices usually does not scale.

Asimily supplies identity and risk context for connected assets and enforces rules through Cisco ISE, Aruba ClearPass, Arista, Palo Alto Networks, Fortinet, and other platforms, with additional enforcement points added frequently based on customer requests.

[Related: Integrations]

How Does Zero Trust Control East-West Traffic?

Zero Trust controls east-west traffic by reviewing internal device-to-device communication with the same detail as perimeter traffic, restricting connections to stop lateral movement.

Perimeter security inspects north-south traffic, but lateral movement happens east-west inside internal networks, often bypassing firewalls during malware propagation.

Connected devices on unsegmented networks often lack local security controls, making them vulnerable pivot points. Enforcing least privilege through a NAC restricts traffic even between devices on the same subnet.

Asimily maps east-west traffic for connected assets, recommends policies that remove unnecessary paths, and monitors for new device-to-device connections. Asimily can often be deployed on Cisco and other vendors’ switches for better insight into east-west traffic, running as a low-priority process so it does not compete with switch performance.

[Related: How Poor Device Visibility Undermines Segmentation in Connected Environments]

What Does Continuous Verification Mean for Connected Devices?

Continuous verification reassesses trust when risk changes rather than maintaining fixed access. For agentless devices, verification relies on ongoing monitoring of identity, vulnerabilities, configuration, and behavior.

Reevaluation can be triggered by firmware updates, newly reported vulnerabilities, risky configuration changes, physical moves, or unusual behavior. Any of these may also call for changes to network microsegmentation.

Asimily continuously tracks asset vulnerabilities, settings, and behaviors, and Continuous Segmentation adjusts policies as network conditions change or assets move.

[Related: Continuous Segmentation is Your Best Defense Against Modern Attacks]

How Should a Zero Trust Architecture Respond to a Compromised Device?

A Zero Trust architecture responds to a compromised connected device much as it would to any compromised asset: alert on or automatically quarantine the device, then begin the incident response process.

In OT and building management environments, isolating critical controllers can cause significant operational downtime. Risk context helps security teams choose responses that contain threats without halting operations.

Technical evidence, including packet captures and traffic history, helps identify suspicious actions and determine whether adjacent systems need isolation.

Asimily flags unusual behavior across connected assets, triggers response actions up to NAC isolation, and provides native packet capture for investigation and root cause analysis.

[Related: Threat and Response]

Choosing Zero Trust Tools

What Tools Are Good for Zero Trust?

Zero Trust relies on multiple tools: Identity and Access Management (IAM) for users, endpoint security for managed computers, NAC and firewalls for network enforcement, and visibility platforms for agentless assets.

Organizations with large IoT and OT environments often lack full coverage for agentless assets. While NACs and firewalls enforce rules, they depend on external tools for accurate device identity and context.

Key features for IoT and OT Zero Trust tools include agentless discovery, exploitability-based risk scoring, automated policy creation, simulation before enforcement, and ongoing rule maintenance.

Asimily addresses this need by combining visibility, vulnerability prioritization, Segmentation Orchestration, Configuration Control, threat detection, and native packet capture. Enforcement stays on the organization’s existing NAC and firewall systems.

[Related: Asimily Segmentation Orchestration]

What Is the Best Solution for Zero Trust?

Zero Trust is a program that combines technology, process, and some cultural change, so no single product delivers it on its own.

For the technology component, Asimily is a strong option for extending Zero Trust to connected devices that cannot host software agents or use standard authentication, delivering agentless identity, exploitability-based risk scoring, and policy creation for existing NAC and firewall tools.

While IAM and endpoint security protect users and laptops, agentless connected devices frequently represent the primary gap where implicit trust remains.

Asimily addresses this gap with Policy Auto-Recommendation, NAC-native policy formatting, Policy Simulation, Continuous Segmentation, and threat-triggered isolation. On Gartner Peer Insights, one customer review describes using Policy Simulation to build and test DACLs before implementation. Asimily was also named a Hot Company in OT Security at Cyber Defense Magazine’s 2026 Global InfoSec Awards.

[Related: Platform Overview]

Measuring and Governing Zero Trust

Which Zero Trust Frameworks Apply to IoT and OT?

Key Zero Trust frameworks relevant to IoT and OT include NIST SP 800-207, NIST SP 1800-35, and the Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model. NIST SP 800-207 is the foundational enterprise Zero Trust Architecture standard and addresses all network assets. For OT environments, ISA/IEC 62443 and NIST SP 800-82 provide specialized guidance.

CISA’s Zero Trust Maturity Model spans five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. The Devices and Networks pillars are most relevant to connected devices, calling for full asset tracking and access limits. Department of Defense (DoD) directives set additional requirements for defense organizations.

ISA/IEC 62443 aligns with Zero Trust principles by using zones and conduits to establish segmented, least-privilege security boundaries across industrial environments.

Asimily supports these frameworks by providing device inventory, risk scoring, enforced segmentation, and auditable policy tracking across IoT, OT, IoMT, and IT assets.

[Related: OT Security]

How Do I Measure Zero Trust Maturity for IoT and OT Devices?

Measure maturity across CISA’s four stages (Traditional, Initial, Advanced, and Optimal) using key metrics: inventory coverage, classification depth, segmented device ratio, policy maintenance, and response speed.

Progress moves from manual inventories and unsegmented networks (Traditional) to automated discovery and initial segmentation (Initial), risk-based least privilege (Advanced), and continuous verification with automated updates (Optimal).

Core metrics include the percentage of devices classified to model and firmware detail, the ratio of high-risk devices under least privilege, time to assign policies to new devices, and the portion of mitigated exploitable vulnerabilities. Some organizations use ISA/IEC 62443-4-2, which has dozens of specific checks that help measure maturity and are useful in a Zero Trust context.

Asimily tracks these metrics across connected assets, creating an auditable record of enforcement maturity.

[Related: Inventory and Visibility]

How Do I Report Zero Trust Progress to the Board and Auditors?

Report progress using risk reduction metrics: inventory depth, high-risk devices under active policy, mitigated exploitable vulnerabilities, and ongoing rule management.

Focus leadership reports on trends and business impact, such as declining risk scores and shorter mitigation timelines. Aligning progress with NIST CSF 2.0, NIS2, or Cybersecurity Maturity Model Certification (CMMC) links security efforts to governance goals.

Auditors expect concrete proof: accurate inventories, documented risk rationale, and verified segmentation logs demonstrating ongoing enforcement. Records showing that response processes would execute correctly during a breach give auditors additional confidence.

Asimily logs risk decisions, measures risk reduction with Risk Simulator, and generates compliance-ready enforcement records through Segmentation Orchestration, with reporting designed for Zero Trust maturity tracking and audits.

[Related: Governance, Risk, and Compliance]