Zero Trust file security: how it actually protects sensitive data

Human involvement shows up in 62% of data breaches, and 48% run through a third party (Verizon Data Breach Investigations Report, 2026). The boundary worth defending is no longer the network. Here are the four conditions that make a file-centric Zero Trust architecture verifiable rather than merely claimed, with the checklist to use during vendor evaluation.

Key takeaways

• Breaches increasingly start from legitimate access misused, by an employee or by a supplier, rather than from an attack on network defenses.
• Zero Trust applied only to network access leaves the content exposed once someone, authorized or not, is already inside.
• A file-centric Zero Trust architecture is measured against four verifiable conditions: persistent protection, granular access controls, complete traceability, clear vendor evaluation criteria.
• FileGrant applies those four conditions to the individual document. Connector by CyberGrant extends them to files already sitting in SharePoint and OneDrive, with no migration.
• NIS2, GDPR and DORA put accountability on senior management: compliance is proven with evidence tied to the data, not with a list of installed tools.

Why 62% of breaches start with legitimate access, not an attack

Human involvement appears in 62% of breaches recorded worldwide: a stolen credential, a misconfiguration, a file shared the wrong way. Another 48% run through a third party, a supplier or partner the company had deliberately granted access to (Verizon Data Breach Investigations Report, 2026). Two numbers, one story told from two angles. In most cases the attacker forces nothing. They walk in the front door, with valid credentials or through someone who was supposed to be there.

That dismantles an assumption behind twenty years of security spending: if the perimeter holds, the data is safe. The perimeter can hold perfectly well and the data can still walk out, because the account moving it is authorized, not an intruder who climbed the firewall. The Santander case is the documented version of that pattern: no perimeter defense breached, a cloud vendor as the entry point.

Why the perimeter model no longer protects the data

Firewalls, VPNs, network segmentation, multi-factor authentication: all sound measures, and no serious analysis argues for dropping them. They remain insufficient for a structural reason. They protect access to the system that holds the data, not the data itself. Once a credential is compromised, or once a third-party supplier holds legitimate access, the file moving inside that perimeter is as readable as anyone else’s.

The model was built for a time when data lived on corporate servers, behind a limited set of exit channels, all controlled by the same IT department. Today a confidential document is created on a laptop, synced to a personal cloud account, shared with an outside consultant, and opened by an AI application the company does not govern. The perimeter, meanwhile, is still a network concept. The data barely lives there anymore.

Scale makes the point concrete in the Italian market. Clusit recorded 5,265 serious incidents worldwide in 2025, up 48.7% year over year and up 42% for Italy alone (Clusit Report, March 2026). Those are the numbers that have pushed most of the CISOs we work with beyond legacy DLP.

What changes when Zero Trust is applied to the file

The Zero Trust principle, formalized by NIST in SP 800-207, rests on a simple assumption: no user, device or application should be treated as trusted merely for sitting inside the corporate network. Every access is verified, every time, regardless of origin.

Applied to network access alone, that principle improves security posture but leaves the same blind spot as the perimeter model: what happens to the content after access is granted. A verified user who downloads a file becomes, from that moment, the only control left between the data and the outside world. If their device is compromised, if the file lands on an unapproved tool, if the third-party supplier with legitimate access is breached in turn, network Zero Trust has nothing further to say.

The file-centric version moves verification from the entry point to the data itself. Deciding whether a user may enter a system is not enough. You have to set, file by file and at every stage of its life, who can open, edit, copy or forward it, and revoke that right even after the document has left the corporate environment. It is the same logic behind Zero Trust applied to banking data, where the perimeter was never sufficient even on paper.

What are the four conditions of a file-centric Zero Trust architecture

A marketing label is not enough to tell a real file-centric architecture from one that moves the vocabulary onto the same old perimeter. Four conditions make it verifiable.

Persistent protection. The file must stay encrypted for its entire life, not only while it crosses the corporate network or sits on controlled storage. If the document becomes readable the moment it leaves the monitored environment, once downloaded to a personal device or forwarded by email, the protection on offer is perimeter protection under another name.

Granular access controls. Permission on a file cannot be a binary state, open or closed, fixed at the moment of sharing. It has to separate readers from editors, support automatic expiry, and stay editable after the file is sent. Revoking access to an already shared document, without physically recalling it, is the difference between a real control and a policy that exists on paper.

Complete traceability. Every open, edit or access attempt must produce a verifiable log recording who acted, from which device, and with what outcome. That is the difference between proving, during an audit, exactly who accessed a record and when, and reconstructing that chain afterwards, usually too late for the notification deadline.

Clear vendor evaluation criteria. With 48% of breaches running through a third party, file security depends on who supplies it. Anyone evaluating this kind of architecture should get verifiable answers on where the encryption keys live, who can reach them including the vendor’s own staff, and what roadmap exists toward quantum-resistant algorithms such as CRYSTALS-Kyber, standardized by NIST as FIPS 203 (ML-KEM) in August 2024.

How FileGrant applies the four conditions to the individual file

FileGrant is CyberGrant’s file-centric platform: it encrypts documents with quantum-safe cryptography at creation and keeps encryption, permissions and audit trail attached to the file after it leaves the company. In its case the four conditions are verifiable functions rather than claims. Persistent CRYSTALS-Kyber encryption that survives the download, RBAC permissions with expiry and post-sharing revocation, an activity log per file and per folder, and keys that can be held on-premise in zero-knowledge mode.

One problem usually surfaces right after: confidential documents rarely live in a single platform. They sit in SharePoint and OneDrive, where Microsoft Purview sensitivity labels cover Office formats and leave the rest uncovered. Connector by CyberGrant is the extension that brings FileGrant’s quantum-safe encryption inside SharePoint and OneDrive with no migration. Files stay where they are, users keep their Microsoft login and habits, and encrypted documents are unreadable to tenant administrators and to Copilot alike.

Connector does not replace SharePoint, OneDrive or Purview. It sits alongside them and covers what that stack leaves open: non-Office files, AI reading the content, access from unauthorized devices. The mechanism is described in detail in how to encrypt SharePoint files without migrating anything.

How to verify a file-centric Zero Trust solution before adopting it

The four conditions translate into concrete questions to ask before adopting, or renewing, this kind of solution:

• Does the file stay encrypted outside the corporate network, on unmanaged devices and unapproved cloud services?
• Can permissions be changed or revoked after sharing, without physically recalling the document?
• Does every open, edit or access attempt produce a log usable in an audit or in a breach notification within the statutory deadline?
• Does the vendor state precisely where encryption keys reside and who inside their organization can reach them?
• Is there a stated roadmap, with timelines, toward post-quantum algorithms, or does the architecture rest only on standards a sufficiently powerful quantum computer would render obsolete?
• Is content classified automatically, or does it depend on the user’s judgment at creation, reintroducing the same human error that drives 62% of breaches?
• Does protection also cover files already stored in SharePoint and OneDrive, or does it stop at documents uploaded into the vendor’s own platform?

None of these questions is about a product feature. Each one is about a structural condition. If the vendor cannot answer with verifiable data, what is on offer is probably perimeter protection, not file-centric protection.

What NIS2, GDPR and DORA require on data governance

Directive (EU) 2022/2555 (NIS2), transposed in Italy through Legislative Decree 138/2024, places cyber risk management accountability on senior management and requires, under Article 21, measures that explicitly cover supply chain security. With nearly half of all breaches originating from a third party, that requirement is not a formality. It is an accurate picture of where the risk sits. The measures expected by the October 31, 2026 deadline should be read in that light.

Article 32 of the GDPR has required technically and organizationally adequate measures, encryption included, since 2018. Regulation (EU) 2022/2554 (DORA), applicable to the financial sector since January 17, 2025, extends the same logic to digital operational resilience and to third-party ICT risk. Three different instruments, three different scopes, one direction: compliance is proven on the data and its traceability, not on a list of tools installed.

What stays exposed once the attacker is already inside

For years, the question driving enterprise security design was how to keep out the people who did not belong. With 48% of breaches running through suppliers holding legitimate access, and 62% tied to human error, that question alone no longer guides a budget or a technology choice. The question that matters now is what stays exposed when someone, authorized or not, is already inside, and how long a file stays readable after leaving the perimeter the company believed it controlled.

As long as security remains a property of the network rather than of the data crossing it, every new regulatory obligation will find companies chasing the same moving boundary. The four conditions, and the checklist that follows from them, exist to move the question from where it starts on paper to where it ends in practice: the moment the file, however and wherever, reaches the wrong hands.

Frequently asked questions about file-centric Zero Trust security

What is file-centric Zero Trust security?

File-centric Zero Trust security applies the “never trust, always verify” principle to the individual document instead of the network. Encryption, permissions and traceability travel inside the file and stay active when the document leaves the company, is downloaded to an unmanaged device, or is shared with an outside supplier. FileGrant, CyberGrant’s file-centric platform, implements this model with quantum-safe encryption applied at document creation.

How does it differ from legacy DLP?

Legacy DLP monitors exit channels and tries to block data as it attempts to leave the perimeter. It needs manual classification, produces false positives, and sees nothing when an authorized user moves the file. File-centric protection encrypts the document at creation and retains control after sharing, so it also covers the legitimate insider and the third-party supplier, the two scenarios where perimeter DLP is blind.

How do you revoke access to a file already shared externally?

In a file-centric architecture, permission does not travel with the file. It stays a decision the company can change at any time. With FileGrant an administrator revokes access to an already sent document without recalling it, sets automatic expiry dates, and separates who may read from who may edit or download. The recipient still holds the file but can no longer open it.

Does file-centric Zero Trust replace SharePoint, OneDrive or Microsoft Purview?

No. Connector by CyberGrant sits alongside the Microsoft stack rather than replacing it. Documents stay in SharePoint and OneDrive, users keep their Microsoft login, and Connector adds quantum-safe encryption to every uploaded file, including the non-Office formats Purview labels leave uncovered. Encrypted files are unreadable to tenant administrators and to Copilot. No migration is involved.

What evidence proves NIS2 and GDPR compliance on shared files?

You need logs tying every access to an identity, a device and a precise moment, retained in verifiable form and retrievable within notification deadlines. NIS2 Article 21 requires measures extended to the supply chain; GDPR Article 32 requires measures adequate to the risk, encryption included. A per-file audit trail, such as the one FileGrant produces, delivers evidence that a list of installed tools cannot.

Why does quantum-safe encryption belong in a Zero Trust evaluation today?

Because of “harvest now, decrypt later”: an attacker stores encrypted data they cannot read yet, counting on future computing capacity. For a contract, a clinical record or a patent, value lasts many years past the date of theft. CRYSTALS-Kyber, standardized by NIST as FIPS 203 (ML-KEM) in August 2024, is the reference algorithm for that transition, and the one FileGrant uses.