How to Compute Zero Trust Effectiveness: Four Metrics That Survive a Breach

Three hops captures the realistic post-compromise reach inside a typical enterprise environment. If your IAM tooling does not expose a graph, the practical substitute is "count of distinct resources the identity has permission to read or modify within 60 minutes of session start, assuming no MFA step-up triggers." What good looks like Privileged human identity: under 50 reachable resources, zero crown-jewel data classes without step-up Standard human identity: under 200 reachable resources, no p