Zero Trust Architecture: A Structured Review of Effectiveness, Implementation Challenges, and Component-Level Security Contributions

Md Shahnawaj; Hamim Islam Hellol; Debabrata Biswas; Md Al Ridwan; Roise Uddin; Shamim Akhtar

doi:10.57159/jcmm.5.4.26898

Authors

Md Shahnawaj Pacific States University, Los Angeles, California, USA https://orcid.org/0009-0001-4140-2765
Hamim Islam Hellol Pacific States UniversityPacific States University, Los Angeles, California, USA https://orcid.org/0009-0003-4380-5335
Debabrata Biswas Pacific States University, Los Angeles, California, USA https://orcid.org/0009-0002-3549-0145
Md Al Ridwan Pacific States University, Los Angeles, California, USA https://orcid.org/0009-0004-4958-1501
Roise Uddin Pacific States University, Los Angeles, California, USA https://orcid.org/0009-0007-8835-2877
Shamim Akhtar Pacific States University, Los Angeles, California, USA

DOI:

https://doi.org/10.57159/jcmm.5.4.26898

Keywords:

Zero Trust Architecture, Micro-Segmentation, Least-Privilege Access, Continuous Monitoring, Identity Verification, Cloud Security

Abstract

Background: Cloud computing, remote workforces, and Internet of Things (IoT) deployments have eroded the enterprise network perimeter, exposing the limits of security models that grant implicit trust to internal actors. Zero Trust Architecture (ZTA), governed by the principle of "Never Trust, Always Verify," addresses this through continuous verification, least-privilege access, micro-segmentation, and adaptive monitoring.

Objectives: This paper synthesizes reported evidence on ZTA across three research questions: effectiveness relative to perimeter models, the implementation challenges enterprises face, and the security contribution of individual components.

Methods: A structured literature review was conducted on a predefined corpus of 37 ZTA-related studies. A rubric-based composite model incorporating relevance, methodology quality, recency, and measurability of outcomes characterized each study. All 37 met the appraisal threshold of S >= 3.0, the lowest composite score being 3.55, so the rubric characterized the corpus rather than functioning as an exclusion filter.

Results: Reported findings suggest that ZTA can improve breach detection, reduce unauthorized access, and limit attack propagation in specific empirical and simulation contexts. Headline values, including 75% improvement in breach detection, 66.7% reduction in unauthorized access, up to 80% attack-surface reduction, and 100% repulsion of simulated malicious packet injections, are drawn from a limited number of studies and need replication. Implementation barriers include performance overhead in IoT and edge environments, high transition costs, legacy migration complexity, interoperability gaps, and cultural resistance.

Conclusions: ZTA is a promising and structurally well-aligned security framework for modern distributed environments, but the strength of evidence varies by component and deployment context.

Author Biography

Shamim Akhtar, Pacific States University, Los Angeles, California, USA

References

[1] M. Rakhra et al., "The Zero Trust Paradigm: Revolutionizing Network Security," in Proc. Int. Conf. Networks and Cryptology (NETCRYPT), pp. 1714-1719, 2025.

[2] K. Jayabalan et al., "Implementing Zero Trust Architecture for Enhanced Security in Cloud-Based Systems," in Proc. 9th Int. Conf. Electronics, Communication and Aerospace Technology (ICECA), pp. 1589-1594, 2025.

[3] S. Subramani, A. R. Kavitha, and A. R. Safrin, "Zero Trust Network Architecture for Modern Enterprise Environments," in Proc. Int. Conf. Data Science, Agents and Artificial Intelligence (ICDSAAI), 2025.

[4] A. Rosén, G. S. Gaba, and A. Gurtov, "A Strategic Roadmap for Phased Zero Trust Architecture Implementation in Organizations," in Proc. IEEE Conf. Communications and Network Security (CNS), 2025.

[5] A. Paya and A. Gómez, "Enhancing Software-Defined Perimeters with Integrated Identity Solutions and Threat Detection for Robust Zero Trust Security," Int. J. Inf. Secur., vol. 24, no. 4, 2025.

[6] U. K. Lilhore, S. Simaiya, R. Alroobaea, A. M. Baqasah, M. Alsafyani, A. Alhazmi, and M. M. Khan, "SmartTrust: A Hybrid Deep Learning Framework for Real-Time Threat Detection in Cloud Environments Using Zero-Trust Architecture," J. Cloud Comput., vol. 14, no. 1, p. 35, 2025.

[7] K. Srinivas et al., "Evaluating the Effectiveness of Zero-Trust Architectures in Modern Cyber Security," in Proc. Int. Conf. Sustainability, Innovation and Technology (ICSIT), 2025.

[8] V. K. K. Shashank, "Zero Trust Architecture: A Beginner's Guide," in Cybersecurity Unlocked: Cryptography, Network Security, Data Protection, pp. 227-264, De Gruyter, 2025.

[9] A. Singh, "Enhancing 5G Security Through Zero Trust Architecture: A Threat-Centric Analysis of Critical Interfaces," in Proc. IEEE 4th Int. Conf. Intelligent Reality (ICIR), 2025.

[10] B. Singh and C. Kaunert, "Zero-Trust Evolution and Cloud Computing Security as Multi-Mission Engineering," in Zero-Trust Learning: Applications in Modern Network Security, pp. 357-385, Apple Academic Press, 2025.

[11] C. Uwaoma, "The Challenges and Processes of Achieving Optimal Implementation of Zero Trust Architecture in Workplace," in Proc. ACM SIGMIS Computers and People Research Conf. (SIGMIS-CPR), 2023.

[12] S. Mushtaq, M. Mohsin, and M. M. Mushtaq, "A Systematic Literature Review on the Implementation and Challenges of Zero Trust Architecture Across Domains," Sensors, vol. 25, no. 19, p. 6118, 2025.

[13] N. Antwi, "Managing the Adoption and Implementation of Zero Trust Architecture Cybersecurity: Overcoming Organizational, Cultural, and Compliance Challenges," in Navigating Law and Policy in STM Enterprises, pp. 261-283, IGI Global, 2025.

[14] M. Tsai, S. Lee, and S. W. Shieh, "Strategy for Implementing of Zero Trust Architecture," IEEE Trans. Reliab., vol. 73, no. 1, pp. 93-100, 2024.

[15] T. D. Vilaskar et al., "AccessGuard++: AI-Enhanced Risk Intelligence for Zero Trust Systems," in Proc. IEEE Pune Section Int. Conf. (PuneCon), 2025.

[16] S. Naraboina and R. R. Pagadala, "Unified Security Framework for Hybrid Environments Leveraging VPN Interconnectivity and Zero Trust Principles," in Proc. World Conf. Smart Trends in Systems, Security and Sustainability (WorldSUAS), 2025.

[17] Y. Bobbert and T. Timmermans, "How Zero Trust as a Service (ZTaaS) Reduces the Cost of a Breach," in Lecture Notes in Networks and Systems, pp. 433-454, Springer, 2023.

[18] S. Al-Tamimi, Q. A. Al-Haija, and K. Alrawashdeh, "Zero-Trust Architecture for Securing Internet of Things (IoT) Networks: A Review," in Proc. IEEE Int. Conf. Communications, Information, Electronic and Energy Systems (CIEES), 2024.

[19] P. Bajpayi, S. Sharma, and M. S. Gaur, "AI Driven IoT Healthcare Devices Security Vulnerability Management," in Proc. 2nd Int. Conf. Disruptive Technologies (ICDT), pp. 366-373, 2024.

[20] L. Ahuja, S. Vashisth, and A. Thakur, "Integrating SIEM with Zero Trust Architecture," in Proc. 3rd Int. Conf. Intelligent Technologies (IITCEE), 2025.

[21] N. Alsuwaidi, N. Alharmoodi, and H. A. Hamadi, "The Transformative Impact of Zero-Trust Architecture on Healthcare Security," in Proc. 2nd Int. Conf. Cyber Resilience (ICCR), 2024.

[22] J. Viswanathan, N. D. Kumar, and S. U. Kumar, "Zero Trust Security for Web Applications in Microservice-Based Environments," in Proc. 1st Int. Conf. Data, Computation and Communication (ICDCC), pp. 488-494, 2024.

[23] B. Z. Irtaish, A. Atawnih, and A. Y. Owda, "Zero Trust Cloud Storage and E-Payment in Local Enterprises," in Proc. Int. Conf. Smart Learning Courses (SCME), pp. 113-119, 2025.

[24] A. P. Perumal and V. Ahire, "Implementing Zero-Trust Architecture and Quantifying the Impact on System Reliability and Data Protection in Big Data Cloud Infrastructures," Edelweiss Appl. Sci. Technol., vol. 9, no. 2, pp. 1726-1736, 2025.

[25] S. Bajpai et al., "Adaptive Defense Mechanisms for IoT Ecosystems: A Response to Adversarial Tactics," in Proc. Multimedia Univ. Engineering Conf. (MECON), 2025.

[26] U. Ashitha et al., "Strengthening Cloud Security Through Multi-Factor Authentication: A Comprehensive Integration of Diverse Approaches," in Proc. 1st Int. Conf. Electronics, Computing, Communication and Control Technology (ICECCC), 2024.

[27] N. Sharma et al., "Advantages of Zero-Trust Security," in Zero-Trust Learning: Applications in Modern Network Security, pp. 41-71, Apple Academic Press, 2025.

[28] G. Ahn, J. Jang, S. Choi, and D. Shin, "Research on Improving Cyber Resilience by Integrating the Zero Trust Security Model with the MITRE ATT&CK Matrix," IEEE Access, vol. 12, pp. 89291-89309, 2024.

[29] W. Kou, H. Zhou, and J. Du, "Research on Telecommuting Security Solution Based on Zero Trust Architecture," in Lecture Notes in Electrical Engineering, pp. 82-89, Springer, 2024.

[30] D. Gama, C. Fuch, A. Brito, A. Martin, and C. Fetzer, "Leveraging Zero Trust and Risk Indicators to Support Continuous Vulnerability Compliance," J. Internet Serv. Appl., vol. 17, no. 1, pp. 36-54, 2026.

[31] K. Qu, M. Zhao, and S. Cui, "Zero Trust Security in Modern Networks: A Survey of Applications, Challenges, and Future Directions," in Proc. IEEE Advanced Information Technology, Electronic and Automation Control Conf. (IAEAC), pp. 209-214, 2025.

[32] I. Dhanapala et al., "Contextual Intelligence for Anomaly Detection in Zero Trust Based Architectures," in Proc. IEEE Int. Conf. Smart Computing (SMARTCOMP), pp. 498-503, 2025.

[33] T. Hilbig, T. Schreck, and T. Limmer, "'State of the Union': Evaluating Open Source Zero Trust Components," in Lecture Notes in Computer Science, pp. 42-61, Springer, 2023.

[34] J. Lin et al., "Quantum-Enhanced Zero Trust Security: Evolution, Implementation, and Application," in Proc. Int. Conf. Quantum Communications, Networking, and Computing (QCNC), pp. 211-215, 2024.

[35] R. Jain et al., "Transforming Network Security Through Zero Trust Architecture: Principles, Challenges, and Future Directions," J. Discrete Math. Sci. Cryptogr., vol. 29, no. 2, pp. 1097-1106, 2026.

[36] P. Robinson, "Why Is Zero Trust So Difficult?," Comput. Fraud Secur., vol. 2023, no. 3, 2023.

[37] Z. M. Azmi et al., "Zero Trust Network Access (ZTNA) to Secure Website Applications Based on ISO 25023," in Proc. Int. Conf. Advancement in Data Science, E-Learning and Information Systems (ICADEIS), 2025.