What happened
The article explains that zero-trust programmes are usually owned by teams whose tooling, vocabulary and metrics suit distributed, cloud-native architecture. Mainframe teams run a different stack and rely on access-control systems such as RACF, ACF2 or Top Secret. Because the mainframe security model does not match the primitives assumed by most modern security tools, SAML or OIDC identity providers, endpoint agents and instrumentable network traffic, the mainframe often ends up as a parallel, manually maintained process or a black box that is "someone else’s problem". This separation creates a structural blind spot where the mainframe sits outside the visibility of the broader security programme.
Why it matters
When mainframe environments connect to hybrid infrastructure, web front ends, middleware and integration layers bridge distributed systems to mainframe back ends. Some integrations authenticate on the distributed side with Kerberos or NTLM and then use a separate service identity to reach the mainframe. If a credential is compromised on the distributed side, for example through NTLM relay abuse against a vulnerable integration server, an attacker can move through an overly privileged service account to the mainframe. Although RACF, ACF2 or Top Secret still enforce access controls, the activity may appear legitimate because the service account already has permission. The result is a path that bypasses the conditional-access policies and audit trails that zero-trust programmes apply to cloud workloads, leaving the organisation’s most sensitive transaction processing exposed.
What this means for enterprise IT teams
Teams must treat mainframe identities, permissions and integration paths as part of the enterprise’s overall identity and access architecture. Extending verification and authorization steps, the core tenets of zero-trust, to the middleware-to-mainframe hop is essential. This requires tighter coordination between cloud-focused security teams and mainframe operations, shared vocabularies and joint metrics. Conditional-access policies should be applied to service accounts that bridge to the mainframe, and audit logs from RACF, ACF2 or Top Secret need to be fed into the same monitoring platform used for cloud assets. Visibility into batch and workload performance should also be incorporated, ensuring that any anomalous activity on the mainframe is detected alongside cloud alerts.
In the words of PlanetMainframe: "Zero Trust calls for verification and authorization throughout the access path."
The bottom line
Zero-trust strategies that ignore mainframe workloads leave a structural blind spot where attackers can pivot from compromised distributed services to critical transaction systems. Enterprises need unified identity and access controls that span both cloud and mainframe layers to protect their most sensitive transactions.
Sources
- planetmainframe.com