Mthethwa, SJembere, EDlamini, Thandokuhle M2026-01-122026-01-122025-11979-8-3315-5978-62770-2677DOI: 10.1109/SmartIoT66867.2025.00069http://hdl.handle.net/10204/14575The widespread adoption of IoT devices has fundamentally altered digital connectivity, facilitating real-time data exchange and autonomous interactions worldwide. While this transformation offers significant operational advantages, it also introduces critical security challenges, particularly concerning the Identity and Access Management (IAM) of non-human identities such as sensors, devices, machine agents, and service accounts. Traditional perimeter-based security models, which rely on static trust boundaries and implicit trust for internal actors, have been used over the years for human identities. However, they are inadequate for non-human identities. Their limitations have led to a growing interest in Zero Trust Architecture (ZTA), a cuttingedge security concept, built upon the foundational rule of "never trust, always verify". This paper explores the application of ZTA in securing IoT ecosystems, with a specific focus on managing nonhuman identities. It investigates ZTA’s core tenets, like least privilege, micro-segmentation, continuous monitoring, and identity-centric access control—and analyses how these can be effectively implemented in resource-constrained IoT environments. The study identifies key implementation challenges and considerations for the use of ZTA in IoT. The findings of this paper highlight that ZTA, when properly implemented, offers a robust framework for mitigating cyber risks inherent in IoT ecosystems. Finally, the paper outlines future research directions, aimed at integrating ZTA into IoT environments. Ultimately, this work contributes to the growing body of knowledge advocating for Zero Trust as a foundational approach to modern IoT security.AbstractenCybersecurityDevice authenticationIdentity and access managementInternet of thingsLeast privilegesNon-human identitiesSecurityZero trust architectureIAM-based zero trust architecture for IoT: Securing non-human identities in a connected worldConference Presentationn/a