Zero Trust Requires IAM Hygiene, Not Just Products

Zero Trust Isn't a Product — It's What Happens When You Actually Review IAM Most GCP organizations I assess have a zero trust problem they don't know about. They've configured VPC Service Controls. They've enabled BeyondCorp. They've checked the "zero trust" boxes on their security roadmap. But when I export their IAM bindings to BigQuery and run a simple query, I find service accounts with roles/editor granted two years ago that have never been reviewed. Zero trust without IAM hygiene is securi