In my experience zero-trust environments work well in highly structured corporate settings, but it is unfeasible for smaller organizations without a large and competent IT staff. Their is significant administrative overhead required to maintain a true zero-trust environment. Traditional access controls and personnel management still have a niche, as it is my experience as an IT professional that most small businesses hardly ever upgrade their IT infrastructure, and do not have the desire, know-how, personnel, time or money to do so unless forced to. I can see Target creating an zero-trust environment for it's employees, but not a smaller local retail chain that is typically operating in an IT environment that was probably outdated ten years, and is even worse off now. Of course zero-trust is the way to go in a vacuum, but creating policies that function with existing systems is important to ensure that security can be enforced even at a grocery store that still use Windows NT for their Point-Of-Sale. references