Where most Zero Trust programs stop
Most Zero Trust work focuses on the front door. Is this the right person? Did they pass MFA? Is the device one we know? Those checks matter, but they happen once, at login. After that, whatever the user is allowed to do on the laptop tends to go unquestioned. NIST’s Zero Trust architecture (SP 800-207) asks for more. It says access should be granted per session, decided by policy, and limited to the least privilege needed for the task. That principle doesn’t stop at the network. It applies on the laptop too, every time someone tries to do something that needs admin rights.Why admin rights on laptops are such a big deal
Attackers usually get onto a laptop in one of two ways: a stolen password or a software flaw. According to the 2026 Verizon Data Breach Investigations Report, exploited vulnerabilities (31% of breaches) have now overtaken stolen credentials as the most common way in. Either way, the attacker ends up with whatever rights the user has. With admin rights, the usual next steps in an attack, like dumping passwords, disabling security tools, or installing a backdoor, become easy. Without them, many of those steps simply fail. And this is far from rare. When NSA and CISA listed the ten most common misconfigurations their teams find in large organizations, giving users more admin privilege than they need came second. There’s a timing benefit as well. The same Verizon report found that organizations now take a median of 43 days to patch known vulnerabilities. Removing unnecessary admin rights limits how much damage an unpatched flaw can do while you wait.So why do so many users still have admin rights?
Because taking them away hurts. The developer can’t install the tool she needs. The sales rep can’t update a plugin ten minutes before a client demo. The help desk drowns in tickets. So, companies leave admin rights in place “for now,” and “for now” lasts for years. This is the problem Endpoint Privilege Management (EPM) solves. Most users don’t need to be admins. They need to do a handful of specific admin tasks. EPM lets them do exactly those tasks without handing over the keys to the whole machine.What this looks like day to day
A developer installs Docker. His request is checked against policy: Docker is on the approved list, he’s in the engineering group, and his laptop is compliant. The installer runs with elevated rights, and when it finishes, the rights disappear. He never became an admin, and he didn’t wait on a ticket. An unknown file asks for admin rights. It isn’t on any approved list, so the request is blocked and the security team gets an alert. This is Priya’s story with a different ending. The malware still ran, but it couldn’t turn off the antivirus or grab passwords, because it never got admin rights. A contractor needs access for two weeks. He must configure software on three machines. He gets elevated rights for that job, on those machines, until the engagement ends, and every action is logged. That matters: Verizon’s latest report found third parties involved in 48% of breaches [2]. A help-desk engineer fixes a broken driver. Instead of being a permanent admin on every laptop in the company, she gets elevation for the approved support tools she uses, and each session is recorded. In each case, the question goes beyond “who is this?” It becomes: which app, on which device, for what task, and for how long?Rolling it out without making enemies
Pulling admin rights from everyone on a Monday morning is the quickest way to kill an EPM project. A few things work much better:- Watch before you block. Run EPM in monitoring mode for a few weeks to see what really needs admin rights.
- Remove rights in waves. Build rules from what you learned, then start with low-risk teams and expand.
- Make asking easy. If getting elevation takes a day, people will find workarounds.
Where ARCON EPM fits
ARCON Endpoint Privilege Management is built for exactly these situations. It manages Windows, macOS, and Linux endpoints from one console [5] and gives security teams:- Just-in-time elevation that expires on its own once the task or time window ends
- Application control, with allow and block lists based on each app’s risk
- Request and approval workflows that work even when users are off the corporate network
- Vaulting and automatic rotation of local admin passwords
- Audit trails and behaviour analytics that flag unusual activity
- Integration with ARCON Privilege Account Management, so endpoint privileges are managed alongside servers, databases, and cloud accounts
One more reason these matters: AI
AI agents are starting to run on employee laptops, reading files, running scripts, and installing packages on the user’s behalf. They do it with the user’s permissions. If the user is an admin, so is the agent, and it moves far faster than any person would. Verizon also found that employee use of unapproved AI tools has tripled, to 45% [2]. Checking each privileged action, rather than trusting the whole session, is the only approach that keeps pace.The bottom line
Priya’s login was fine. What went wrong was everything her account was allowed to do afterward. Zero Trust is meant to remove assumptions, and “this person signed in, so they can do anything on this laptop” is one of the biggest ones left. That’s why Zero Trust can’t stop at login. It must carry on to the endpoint, where the real work happens. References- NIST, Special Publication 800-207: Zero Trust Architecture. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf
- Verizon, 2026 Data Breach Investigations Report. https://www.verizon.com/about/news/breach-industry-wide-dbir-finds
- MITRE ATT&CK, OS Credential Dumping (T1003) and Impair Defenses (T1562). https://attack.mitre.org/techniques/T1003/
- NSA and CISA, Joint Advisory AA23-278A: Top Ten Cybersecurity Misconfigurations. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a
- ARCON, Endpoint Privilege Management. https://arconnet.com/endpoint-privilege-management/
