The Nine Dimensions of Zero Trust

Most zero-trust guidance, including CISA's Zero Trust Maturity Model 2.0, presents stages: traditional, initial, advanced, optimal. Program managers like it because it produces a progress bar. To be fair to CISA, the model scores each of its five pillars separately, so an organization can sit at different stages per pillar. What the ladder cannot express is coupling between choices, and whether a stage fits the threat model at all. The NSA's Zero Trust Implementation Guidelines (January 2026) already step away from the single ladder: they are modular, and organizations pick the capabilities most relevant to them.

A solo operator running a remote company and a Fortune 500 with a nine-figure budget face different adversaries and inherit different legacies. A ladder cannot express that; a configuration space can. The matrix has nine dimensions, each with a range of realistic positions, and every deployment maps to one value on each, whether or not anyone wrote it down.

None of this is new method. The morphological matrix is Fritz Zwicky's, from the 1940s, and Tom Ritchey's General Morphological Analysis added the cross-consistency step that finds which combinations can coexist. Zero trust itself goes back to John Kindervag's 2010 Forrester report and Google's BeyondCorp. What is new here is applying the method to zero-trust architecture, so that Forrester's ZTX pillars, CISA's five pillars and the DoD's seven become things the matrix cuts across rather than competes with.

D1 answers one question: why should any component of this system believe anything? The positions run from a software CA, through behavioural trust and hybrid hierarchies, to a silicon root of trust, and finally a distributed multi-party root where no single authority can bootstrap trust alone.

In the architectures I review, most sit on the first position: Kubernetes has its cluster CA, Istio its mesh CA, and most cloud workload identity ultimately rests on a key or CA held in software. That stops man-in-the-middle attacks, not attestation forgery. A software CA will sign a certificate for a workload that passed no runtime integrity check, and anyone with CI/CD access can mint identities at will. Behavioural trust has the mirrored weakness: an attacker who holds a component long enough to establish a baseline is trusted by the mechanism built to catch them.

D2 runs from static just-in-time tokens (minted at login with a fixed lifetime of hours and trusted until they expire), through attribute-based access, delegated capabilities, trust that decays after authentication and probationary identity, to zero standing privileges where no persistent account exists. It requires a bifurcation most deployments get wrong: human identity wants zero standing privileges and behavioural signals, while machine identity wants cryptographic workload attestation, where the identity is minted from a verified hash of the running code rather than a declared service account name. Swapping the two creates structural weakness.

D3 asks where policy is actually evaluated: the network perimeter, the service mesh sidecar, the application or API gateway, the data itself through cryptographic policy envelopes, the silicon or hypervisor, or bilateral enforcement where client and server evaluate policy independently and the request proceeds only if both allow. Each position removes a class of bypass rather than replacing the one below it, and the last is where most commercial zero trust quietly stops: unilateral enforcement, where the server decides and the client obeys, is the norm, and it is not zero trust.

D4 is the evidence behind the verdict. It runs from none at all (the book calls this trust on first use: whatever the pipeline delivered is believed), through single-source, behavioural, cascading attestation from silicon upward and continuous attestation, to a heterogeneous triple where a kernel probe, a hypervisor monitor and hardware counters emit separately signed observations that no single vulnerability can forge together. Single-source attestation is the root cause of the stolen-token-equals-total-breach pattern: if the only evidence is that a token validates, whoever holds the token is the user.

D5 is the highest-leverage dimension in the matrix, because it determines whether a detection produces business damage or intelligence. Its positions are hard deny, graceful degradation, micro-friction, auto-escalation to a human, a static honeypot, and trickle-truth, where the attacker is served convincing synthetic data through an environment that keeps working normally and never signals that they were caught. The book calls that environment the garden.

Hard deny is the default in most products I have reviewed and a worse choice than its popularity suggests. By the time it fires, the real data has usually already left, the attacker knows they were detected, and the lockout produces an outage for legitimate users. The response itself becomes a fault that cascades: the defender pays and the attacker does not.

D6 looks administrative and is not. It runs from scheduled push from a central control plane, through just-in-time pull, GitOps sync (slow, but replayable from Git history), policy embedded in the data it protects and bilateral consensus on the policy version, to event-streamed distribution reaching global subscribers in milliseconds. D5 and D6 are coupled: deception only works if the instruction to move a session into the garden reaches every enforcement point before the attacker notices.

D7 asks whether the monitoring pipeline is itself trustworthy, and every non-aspirational archetype in the book fails here. The standard position is implicit trust: the SIEM and the agent logs are believed because they are ours. An attacker who pauses a logging agent produces silence, and silence reads as normal. Above it sit sequence-verified ingestion, a silent air-gapped second pipeline, Merkle-attested telemetry where altering any observation breaks the chain, and at the top heterogeneous observer consensus, where kernel, hypervisor and hardware observers must agree before an observation is accepted.

D8 is organizational posture, the only dimension whose first upgrade costs nothing. It runs from siloed, where the handoff seams between SecOps, IT and procurement are the attack surface, through fused, where the same people share incident response and blast radius, economic-contract, where security spend is sized against attacker tiers and recovery costs rather than checklists, and presumptively wrong, where every architectural decision is treated as provisional, to dojo-trained, where teams train together against live red teams. Moving from siloed to fused requires no hardware, no software and no vendor.

D9, human continuity, was not in the original framework; it surfaced when the solo-operator case was mapped. Its positions are a single point of failure, a rotation of two or three, real shift coverage, and full automation. A deployment whose response is auto-escalation to a human, with one person on call, has a bimodal response time: about three minutes when that person is at their desk, 25 minutes or more when they are asleep. The slow peak is the one that sets the loss. Human availability is an architectural parameter.

The canonical values, ordered from least to most mature, are the same ones the Octagon overview and the archetype traces use. D1 trust anchor: software CA, behavioural, hybrid hierarchical, silicon root of trust, distributed multi-party. D2 identity model: static just-in-time tokens, attribute-based, delegated capabilities, trust decay, probationary identity, zero standing privileges. D3 enforcement layer: network perimeter, service mesh, application or gateway, data, silicon or hypervisor, bilateral.

D4 attestation: none (trust on first use), single source, behavioural, cascading, continuous, heterogeneous triple. D5 violation response: hard deny, graceful degradation, micro-friction, auto-escalation to a human, static honeypot, trickle-truth. D6 policy distribution: scheduled push, just-in-time pull, GitOps sync, embedded in the data, bilateral consensus, event-streamed.

D7 observability trust: implicit, sequence-verified ingestion, dual pipeline, Merkle-attested telemetry, heterogeneous observer consensus. D8 organizational posture: siloed, fused, economic-contract, presumptively wrong, dojo-trained. D9 human continuity: single point of failure, small rotation, 24/7 SOC, fully automated.

The matrix also maps onto assessments you may already have. The CISA column follows the book's crosswalk (Appendix E), which ties each function of the five ZTMM pillars and the three cross-cutting capabilities to the dimensions it exercises. The NIS2 column is the author's reading of the minimum measures in Article 21(2), points (a) to (j); the book does not map NIS2. Its access-control, asset-management and multi-factor authentication measures, points (i) and (j), detailed further in Implementing Regulation (EU) 2024/2690, fall on D2, D3 and D4, so an existing NIS2 evidence pack is a reasonable first draft of a reading.

The matrix is only useful if the position you write down is the one you actually occupy, and the honest answer is usually a step lower than the slide deck. The test for each dimension is an artefact, not an opinion. For D1, name the key and say where it is stored. For D9, call the backup responder at three in the morning.

A completed reading is one string and a precise architectural fingerprint. The book's Archetype D, the SaaS-glued lean defense, reads: software CA, static just-in-time identity, an API gateway, single-source attestation, auto-escalation to a human, push distribution, implicit trust in vendor logs, a fused organization, one responder. It describes what the architecture does; it is not a claim that it is secure. A dimension nobody can characterize is one the vendor default decided for you.

The values above give nearly 3.9 million combinations, and most of them cannot stand up. The most common mistake in using the matrix is treating the nine dimensions as independent choices. Values co-vary, and the space contains two dominant clusters, with most deployments in the low one. The low-maturity cluster is software PKI, single-source attestation, push distribution, hard deny, implicit observability and a siloed organization. Those six hold each other down. Upgrade attestation alone and you detect more, more accurately, and feed the better detections into a response that produces outages. The high-maturity cluster is the mirror image: silicon anchor, heterogeneous attestation, event-streamed policy, trickle-truth, heterogeneous observer consensus and a presumptively-wrong organization, each value enabling the next. This is why single-dimension upgrades disappoint and why attestation and response must move together. Posture moves first in practice, because it is free.

The matrix describes configuration. It does not score security. There is no total and no colour-coded grade, and adding one would reintroduce the maturity-ladder thinking it exists to replace. A position high on every dimension is expensive and may be wrong for the threat model; a position low on several may be entirely defensible against a modest adversary.

It also does not replace the axioms. A configuration can be coherent, deliberate, well documented and still fail, because a defensible position does not survive a violated axiom. Unilateral enforcement fails bilateral symmetry however good the attestation feeding it. A single responder paired with human-escalation response fails Byzantine fault tolerance. The matrix tells you where you are; the axioms, scored pass, partial or fail in the Octagon's audit, tell you whether that position can hold.

That is the point. "Are we zero trust?" is unanswerable. "Where are we positioned on each of nine coupled axes, and is that position deliberate?" is answerable, uncomfortable, and produces a document you can defend to an auditor and use during an incident.