Your IoT devices are not laptops. Almost every Zero Trust product on the market assumes they are.
The standard model puts an agent on the endpoint. The agent checks device posture, proves identity, and brokers the connection. That works on a managed laptop. It does not work on a water meter with 64KB of memory, a fall-detection sensor that wakes up twice a month, or an electric vehicle charger whose firmware was frozen by the manufacturer 3 years ago.
So the question is not whether Zero Trust applies to devices that cannot run security software. It is where the enforcement point moves when the device cannot hold one.
It covers how Zero Trust principles apply to headless devices, where enforcement moves when the endpoint is out of the picture, and which parts of the model still depend on you.
It does not claim that Zero Trust hardens your devices. A sensor with a hardcoded password is still a sensor with a hardcoded password. What changes is what that sensor reaches, and what a compromised session gets access to.
It does not claim that any connectivity product makes you compliant with a regulation. Technical controls are one input into a compliance posture that you own.
NIST defines Zero Trust in SP 800-207 as a set of principles that removes implicit trust based on network location. Being inside the perimeter grants nothing. Every request gets authenticated and authorised against policy, per session, using whatever signals are available at that moment. Access granted is the minimum needed for the task, and it expires.
Read that back and notice what it does not require. It does not require software on the endpoint. Agents are the common way to collect device signals and to broker connections. They are an implementation choice, not the principle.
Three constraints show up over and over in real fleets.
No headroom. Constrained devices run a real-time operating system or bare-metal firmware. There is no package manager, no spare flash, and no CPU budget for a TLS-inspecting agent. Adding one shortens battery life on devices specified for a 10-year field life.
No control over the image. In industrial and utility deployments, the device belongs to a hardware vendor who owns the firmware. You are not permitted to install anything, and a modification voids your support contract.
No update path. An agent that is never patched becomes the vulnerability it was installed to prevent. Fleets of 50,000 devices across 12 countries do not get uniform update coverage, and the stragglers are the ones an attacker finds.
The workaround most teams land on is a VPN terminated on a gateway. That moves the problem rather than solving it. The gateway holds credentials for the whole network, the devices behind it sit on a flat subnet, and any device that gets compromised reaches the others.
When the device holds no enforcement point, the network becomes one. Four mechanisms do the work, and keeping them distinct is what makes the architecture reviewable.
Cellular already solves device identity. The SIM authenticates to the mobile core before any traffic flows, and that identity is cryptographic, hardware-bound, and remotely revocable. An IP address tells you where a device sat during one session. A SIM identity tells you which device it is, in which country, on which network, across the whole deployment.
This is the signal an agent would otherwise supply. It arrives without touching the device.
IXT SecureNet keeps device traffic off the public internet, routed privately to your data centre or into AWS, Azure, GCP, or Alibaba. No public IP on the device. No open inbound port for a scanner to find. You can't attack what you can't see.
Worth being precise about the limit here. Private routing hides traffic. It does not inspect it, and it does not stop a compromised device from reaching its neighbours. A private APN hides traffic but doesn't defend it, because the inside is still flat.
This is where Zero Trust becomes enforcement rather than architecture. Every connection request goes to a broker, the Zero Trust Exchange, which checks the device identity, the destination, the time, and the policy before a path opens. Traffic is device-initiated and outbound only, reached by an App Connector that dials out from inside your environment. Nothing listens for inbound connections.
Each device gets least privileged access: the single application it needs, and nothing adjacent to it. A compromised meter reaches the metering head-end. It does not reach the SCADA network, the other 4,000 meters, or the corporate domain controller.
The enforcement runs in the network and the cloud. The device does nothing except send its traffic as it always did.
IXT Zero Trust Visualisation maps real traffic across every connected device, so policy gets written against what devices do rather than against what a design document said they would do. Policy-based segmentation contains a breach to a single device and prevents lateral movement across the fleet. Anomaly detection flags a device that starts speaking to something it never spoke to before.
The map is scoped to IXT-connected devices. Traffic on other providers' networks is not visible to it.
The strongest argument for agentless Zero Trust is rarely the devices. It is the people who service them.
A European electric vehicle charging operator with 8 hardware vendors needed to give each vendor access to their own chargers, without VPN conflicts and without granting network-wide access. Privileged Remote Access gave each vendor a browser session for SSH, VNC, or RDP, time-limited to agreed hours, session-recorded, initiated from the Zero Trust Exchange. No client install on the vendor side. No IP conflicts between 8 different vendor networks. No access beyond the specific charger.
The recording matters as much as the restriction. You get a full audit trail of every device, every user, every third-party contractor that accessed that device, and what actions they took. When an incident review asks who touched the charger before it failed, the answer is a video, not a guess.
IXT Zero Trust addresses NIS2 Article 21(2) technical controls: access control, network segmentation, incident detection, supply chain access, audit trail, and continuous authentication. NIS2 places personal liability at board and C-suite level, and Zero Trust is one of the technical measures that demonstrates control.
What stays with you: risk documentation, incident response plans, staff training, and supplier governance frameworks. No connectivity provider covers those, and any provider that says otherwise is selling you a problem for later.
It collects fewer device posture signals, because there is nothing on the device reporting patch level or disk encryption. It applies the same per-session authorisation, least privilege, and segmentation. For hardware that never runs an agent, the comparison is not agentless against agent-based. It is agentless against a flat network behind a VPN.
No. The SIM supplies device identity. Enforcement happens in the network and the cloud, at the broker that authorises each session. When you see "Zero Trust SIM" in a headline, that is shorthand for 3 things working together: SIM identity, SecureNet private networking, and a Zero Trust layer checking every session.
Not the headless ones, because they require an agent your devices cannot run. IXT extends Zscaler ZTNA to IoT and OT devices over cellular, which is the part of your estate your existing deployment cannot reach. IXT has been Zscaler's named partner for Zscaler Cellular since July 2025.
Nothing on the device changes. Enforcement moves at the network layer, so the change is to routing and policy rather than to firmware. That is the main practical reason this model gets chosen for fleets already in service.
No. It reduces what an incident reaches and produces the session records your SOC investigates with. Detection and response remain a security operations function.
IXT qualifies Zero Trust conversations at 500 or more devices, or below that where there is a compliance obligation or third-party vendor access to control. Under 100 devices with no security pressure, start with connectivity and revisit when the fleet grows.
Zero Trust never needed an agent. It needed an enforcement point and a trustworthy identity. On IoT hardware, both of those live in the network, because the device has nowhere to put them.
Ask us how it works for your deployment. Book a demo at ixt.io