The Case for Local Zero Trust

By Sarang Warudkar - Sr. Technical PMM

November 13, 2026 5 Minute Read

AI Moved Inside Your Network. Your SSE Did Not.

Zero trust took off in earnest when workers went remote and applications moved to the cloud. Cloud Access Security Brokers (CASB), and later, the broader Security Service Edge (SSE) and Secure Access Service Edge (SASE) markets, grew quickly because they answered the risk of that moment: an attacker with stolen credentials reaching corporate cloud resources from anywhere. Zero Trust Network Access (ZTNA) arrived the same way, as SSE vendors extended their cloud platforms to offer a cheaper and less brittle alternative to the VPN. The principle was right and still is. Validate the user, the device, the location and the surrounding context, rather than trusting a credential on its own.

What has changed is not the principle. It is where the work happens.

Why the work came back inside

Four changes have moved a growing share of enterprise activity back onto private networks.

1. People returned to the office. A May 2026 Gallup survey puts 74% of employees in the office or hybrid, 22% of them on-site full time and 52% hybrid at 2.3 days a week. More enterprise sessions now begin and end on the same corporate network than at any point since 2019.
2. AI followed them onto company infrastructure. AI has moved onto company infrastructure as rising token costs, control issues, and data privacy concerns push workloads in-house. When an AI model trains on internal data, such as R&D, pricing logic, and customer records, it absorbs the company’s core intellectual property and effectively becomes a working copy of its trade secrets. Because boards are unwilling to leave those assets on third-party servers, running private models and internal AI tools inside private data centers is now standard practice.
3. Much of the actions these systems take, never crosses the perimeter. Gartner puts proprietary data in 1 in 6 AI prompts (Cybersecurity Threat: AI Application Compromise, 2026), and nothing in that ratio improves when the model is internal rather than public. An internal copilot has nothing to exfiltrate. It reaches into the document store, the ticketing system and the customer database, because reaching into them is what it was built to do. An agent handed a task holds standing credentials and acts far faster than the person who authorized it, against systems on its own network segment.
4. Sovereignty brings the working model back too. Gartner expects 50% of multinationals, and more than 75% of non-US multinationals, to have digital sovereignty requirements by 2028 (Forecast Analysis: Sovereign Cloud IaaS, Worldwide, 2025). An organization that brought a model in house precisely to keep regulated material under its own jurisdiction has a fair question about any architecture that routes the interaction somewhere else to inspect it.

Where cloud-delivered enforcement stops fitting

Embedding zero trust access controls in a cloud-delivered service makes complete sense when the user is remote or the application is in the cloud. It makes considerably less sense once both ends sit inside the same building.

Routing an in-office session, or agentic traffic moving at machine speed, out to a cloud point of presence for inspection and enforcement, only to send it straight back to a private application or data source two floors away, does not hold up architecturally. It adds latency, consumes WAN capacity, and places a dependency on the internet circuit in front of work that never needed to leave the site. Availability becomes a security decision, which is rarely where anyone wants it.

Cloud ZTNA carries a second and quieter weakness. It typically grants zero trust access to the network rather than to the individual application the user actually needs. The session is over-privileged the moment it is admitted, and lateral movement inside that segment goes unchallenged. A control bought to remove implicit trust ends up reintroducing it one layer down.

None of this is unfamiliar ground for the network team. Segmentation, and visibility across east-west traffic has been a goal for years, but delivering local zero trust without impacting user behavior and risk has been challenging. Unfortunately, next generation SSE capabilities like  application-level access, web and TLS inspection, and data-aware controls, have often been out of reach to protect internal networks. This gap is architectural rather than conceptual, which is also why closing it is an engineering exercise rather than a new doctrine.

With data workflows now running at machine speed across local networks, local application-level access control and local in-line inspection stop being an aspiration and become a hybrid design requirement. They protect critical data where that data actually lives and flows, and they keep the business running when the path to the cloud does not.

What moving enforcement closer actually buys

Local data sprawl becomes visible. Internal AI tooling arrives without a procurement record and becomes business-critical before anyone inventories it. Copies of regulated material accumulate in vector stores, fine-tuning sets and shared drives that no cloud-facing control ever sees, because nothing in that workflow crosses a boundary. Inspection on local infrastructure and workflows is the only thing positioned to find it.

Access narrows from the network to the application. Per-application authorization on the local enforcement point removes the over-privilege that network-level brokering leaves behind, and it does so for the in-office user, who is currently the least inspected user on the estate.

AI-specific exposure becomes addressable. Prompt injection, jailbreak attempts and proprietary material pasted or typed quietly into a prompt can only be acted on by something sitting in the path of the interaction at the browser level. When that interaction never leaves the site and nothing on site is in its path, the controls have nothing to work with. Putting local traffic back in scope is what makes AI security applicable, wherever the control itself ultimately executes.

Resilience improves rather than degrades. A site that enforces locally keeps inspecting and keeps applying access policy when the circuit to the cloud fails. A cloud-only architecture facing the same outage chooses between stopping work and waving it through, and nobody makes that choice well at short notice.

Where SSE has to catch up

None of this is a forecast. People are in offices now. Models are running on company infrastructure now. Regulators are asking the sovereignty questions now and show no sign of losing interest.

What has not caught up is where the SSE controls need to sit. Cloud SSE inspection and enforcement still assumes the risk is on its way out of the building, which describes less of the picture every quarter.

Ask your vendor to help you understand how they protect local AI-powered working;  Which controls execute on premises, which run in the cloud, and what happens to each one when the link between them is down.

Find out how the new Skyhigh Hybrid Mesh SSE platform is extending Zero Trust inside the office to better protect AI.

Back to Blogs