Evaluating the Effectiveness of Zero Trust Architecture in Modern Enterprises: Moderating Role of Organisational Maturity

3. MATERIALS AND METHODS

The study adopts a quantitative method to investigate the effectiveness of ZTA in modern enterprises, focusing on the moderating role of organisational maturity. The survey-based method was selected to obtain the information of IT managers directly involved in the decision-making process on cybersecurity issues and to ensure that the information corresponds to the applied difficulties and approaches to ZTA adoption. This approach enables gaining a wide range of opinions from the respondents who are professionals in the actual implementation of Zero Trust in UK institutions. The research instrument used in the study is a structured survey questionnaire, which was formulated in line with available literature. The target audience included IT professionals, managers and cybersecurity decision makers who were directly engaged in implementing ZTA in UK-based institutions. The questionnaire was based on four parts, including demographics, ZTA implementation, modern enterprise performance and organisational maturity. In order to identify the perceptions of the respondents regarding these critical variables, a five-point Likert scale ranging between Strongly Agree (1) and Strongly Disagree (5) was used. This measure was pilot tested in a relevant, straightforward way, and he feedback corrected the questions. This questionnaire was the primary data collection instrument, as it allowed the investigation of the associations among ZTA adoption, organisational maturity, and enterprise performance. The survey items were designed to capture both the direct and indirect roles of organisational maturity on the successful adoption of ZTA, as shown in Appendix A.

The surveys were shared with 600 potential respondents, reaching their sample size, whereas LinkedIn and personal contacts were used to invite the individuals. Three hundred eighty-seven responses were achieved, translating to a response rate of 66.5%. The 380 responses were obtained after seven missing values were removed from the standard sample to be analysed. Participants were reached through the networking functions on LinkedIn, purpose-specific groups on the site, and direct messaging to selected individuals. Additionally, the survey was shared with the IT professionals, managers, and middle-level managers, ensuring the removal of selection bias. The non-response bias is important as there is a comparatively low response rate. An independent sample t-test was used to check the level of non-response bias, where early respondents (n1 = 25) and late respondents (n2 = 25) were compared. There were no statistically significant differences for ZTA (P-value > 0.1), Enterprise performance (P-value > 0.1) and organisation maturity (P-value > 0.1), indicating that the data collection process was not affected by the non-response bias. The study also considered a common method bias in which the questions used in the survey were highly distinct and measured different constructs. Boxplots were used to check whether there were outliers in the data, and skewness and kurtosis values were used to determine whether the data followed a normal distribution. It was found that the data were not approximately normally distributed, and therefore, PLS-SEM was found to be an appropriate technique. There were no significant outliers that would affect the analysis. Further, the straight-line response technique was questioned, and no indication was identified that there had been excessive usage of the technique; the reliability of the responses was high.

The PLS-SEM was selected due to the normality of the data, which the study of (Hair et al., 2019) also supports. The analysis started with a measurement model test to ensure construct validity and reliability in the form of a Confirmatory Factor Analysis (CFA), where the aspects of loading, composite reliability, and Average Variance Extracted (AVE) were considered. Once the construct validity was confirmed, the structural model was subjected to test variables to investigate the relations between organisational maturity and the effectiveness of ZTA. The relationships were considered significant by looking at path coefficients and p-values.

4. RESULTS

4.1. Demographics

The demographics of the study sample, as depicted in Table 1, which consists of 380 respondents, show that gender and age groups are represented. Of 380 respondents, 60.2% were males, with 39.8% female, as shown in the table. This means that a higher number of males participate in the study than females; hence, the trend in the cybersecurity industry is that the number of male professionals is usually higher than that of female professionals. Gender distribution, however, is also reflective with great female representation, so there is a level of gender diversity in the sample.

Regarding age distribution, most respondents are 30-39, which makes 38.2% of the overall sample. This group of people forms a significant percentage of the human resource base in the cybersecurity industry, which people with extensive experience usually dominate. Additionally, 20 to 29 years old, this group had 28.1% of the respondents, comprising younger professionals, who were maybe at the beginning of their careers. The age groups of 40 to 49 years had 22.1%, and the age group of 50 and above had 11.6%. The results of the education level data indicate that most respondents are at an undergraduate level, with a population of 42%. The percentage of postgraduate respondents was 31%, whereas the percentage of respondents with other educational qualifications was 26%.

Table 1. Demographics.

4.2. Measurement Model Using Confirmatory Factor Analysis

As per Table 2, the reliability and convergent validity of the constructs utilised in this study were tested thoroughly, with the existing metrics that rigorously tested the robustness of the measurement model. As per (Hair et al., 2019), both Cronbach’s alpha and composite reliability are key indicators of internal consistency, with values above 0.7 confirming results, Table 2. The Cronbach alpha value of Zero Trust Architecture (0.852), Modern Enterprises (0.815) and Organisation Maturity (0.885) in this study are above the threshold; thus, showing a high internal consistency on the different constructs, Table 2. The composite reliability scores of these constructs vary between 0.839 and 0.885, confirming the reliability and stability of the measurement instrument. The findings indicate that the constructs are highly consistent, ensuring that items used to measure the constructs are highly reliable.

The convergent validity estimated by the Degree of correlation of the items that are part of the same construct was measured employing the AVE. According to (Hair et al., 2017), good convergent validity is represented by a value exceeding 0.5, Table 2. The AVE values of Zero Trust Architecture (0.772), Modern Enterprises (0.729), and Organisational Maturity (0.813) exceed 0.5, implying that the measurement items fit their respective constructs. The measurement model is further validated since the factor loadings were greater than 0.6, Table 2. In particular, the item loadings are all within the acceptable range, ensuring they effectively represent their latent construct. The strong reliability and convergent validity scores provide a solid foundation for the structural analysis, confirming that the constructs are accurately measured and that the path relationships can be interpreted confidently (Cheung et al., 2024).

Table 2. Reliability and convergent validity testing.

As per Table 3, the discriminant validity of the constructs is determined by the ratio of Heterotrait-Monotrait (HTMT), which is widely used to determine whether the constructs are distinct from one another (Henseler et al., 2015). As stated by (Rönkkö & Cho, 2022), the HTMT ratio must be less than 0.85 so that constructs are not highly correlated, thus confirming their discriminant validity Table 3. The relationship between Modern Enterprise Performance and Organisational Maturity is 0.547, indicating a moderate relationship between these constructs. Additionally, they are related but represent different dimensions of organisational performance. Similarly, Modern Enterprise Performance and Zero Trust Architecture have an association value 0.617. Organisational Maturity and Zero Trust Architecture is 0.718, also within the acceptable range of discriminant validity, as depicted in Table 3.

The construct between Organisational Maturity and Zero Trust Architecture, which characterises the moderator of the organisational maturity in the effectiveness of ZTA, is found to be 0.107 with Modern Enterprise Performance and 0.436 with Organisational Maturity, which implies a weak relationship. The strongest relationship is indicated between Organisational Maturity and Zero Trust Architecture, with a value of 0.354, implying that constructs are related but not so strongly as to be indistinguishable.

Table 3. Discriminant validity.

4.3. Path Analysis

The results of the structural model indicated in Table 4 reveal the connections between the organisation maturity, Zero Trust Architecture, and performance in modern enterprises. A direct influence between Organisational Maturity and Modern Enterprise Performance is also statistically significant (β = 0.293, p = 0.000), implying that the effect of organisational maturity on enterprise performance is positive. This is to imply that mature organisations can easily adopt and enjoy the benefits of cybersecurity interventions like ZTA. Additionally, results in Table 4 also show that the use of Organisational Maturity as a moderator and Zero Trust Architecture influences the performance of the Modern Enterprise (β = 0.123, p = 0.022), demonstrating that organisational maturity strengthens the relationship between ZTA and enterprise performance. It implies that organisations with a high level of maturity will respond better to Zero Trust Architecture. Moreover, the zero-trust architecture has a powerful direct impact on Modern Enterprise Performance (β = 0.388, p = 0.000), which indicates that ZTA itself significantly influences improving the Performance of Modern Enterprises, as depicted in Table 4. Therefore, the findings imply that an organisation that is well developed in cybersecurity can make better use of ZTA to enhance individual performance. The implications of the whole findings are outlined by the significance of both organisational maturity and ZTA in enhancing modern enterprise success amid the emerging changes relating to cybersecurity threats.

Table 4. Structural model.

Note: **p < 0.05 (significant at the 5% level)

***p < 0.01 (significant at the 1% level)

4.4. Model Explanatory Power

Table 5 shows that the R-square and Adjusted R-square values of Modern Enterprise Performance evaluate the model; in this case, the model has Hypothetical and Expected explanatory power. The value of R-square (0.325) indicates that the independent variables in the model would explain about 32.5% of the variance of performance in modern enterprises. This shows moderate explanatory power, suggesting that though the model explains a considerably higher percentage of the variance, other things may also determine enterprise performance that are not reflected in the model.

Table 5. Model quality assessment.

H1: The adoption of ZTA has a significant positive impact on enterprise performance.

H2: Organisational maturity significantly moderates the relationship between ZTA adoption and enterprise performance.

5. DISCUSSION

The results of the current study have validated that adopting ZTA has a significant positive impact on enterprise performance, leading to the acceptance of H1 of the study. The effectiveness of ZTA in modern enterprises has been widely embraced as a viable approach to combating evolving cyber threats. As advocated by (Bashir, 2024; and Sunkara, 2025), ZTA’s “never trust, always verify” philosophy ensures that all network traffic, regardless of its origin, is continuously authenticated and authorised. (Hasan, 2024) further validated that this approach has been helpful in cloud and hybrid workforce organisation contexts. ZTA enhances security by reducing attack surfaces through micro-segmentation, least-privilege access, and constant monitoring, making it a great approach in combating advanced persistent threats and data breaches (Mensah, 2024). Nonetheless, although prior studies have been keen to note such technical advantages, the present study further broadens that knowledge by noting how ZTA enhances the operational performance of businesses. The research gives fresh information on how ZTA can get much more important results in contemporary organisations, and the paper by (Brezavšček & Baggia, 2025) agrees with this view and emphasises the necessity of ZTA in enhancing the security of enterprises.

The study’s findings confirm that organisational maturity plays a significant moderating role in the effectiveness of ZTA, which leads to acceptance of the second hypothesis, H2, of the study. The study results are consistent with those of (Ghaffari & Arabsorkhi, 2018; and Yeoh et al., 2023), who state that the maturity of cybersecurity plays a significant role in implementing such intricate cybersecurity solutions. The results show that older organisations stand a better chance of addressing the legacy system integration obstacles, which, as stated by (Nasiruzzaman et al., 2025), is one of the obstacles to integrating legacy systems. Drawing a contrast, previous studies, including (Bashir, 2024; and Sunkara, 2025), concentrated more on the technical side of ZTA, overlooking the matters of organisational maturity that undoubtedly impact the scalability of ZTA and its success. This paper fills that gap to provide a thorough picture of how the readiness and maturity of the organisational environment predetermines the success of ZTA implementation in the real world. Moreover, the moderating effect of organisational maturity reveals that mature organisations are better positioned to benefit from ZTA, including a lack of security breaches and operational efficiency. This aligns with (Kotilingala, 2025), who explained that more mature organisations can embrace the new cybersecurity models, i.e., machine identities and IoT security.

The present research contributes to the knowledge of the ZTA implementation by indicating that the moderating effect of organisational maturity impacts its effectiveness. Existing studies by (Brezavšček & Baggia, 2025; and Yeoh et al., 2023) supported the relevance of organisational maturity in cybersecurity frameworks and, to some extent, were focused on its effects on the successful adoption of ZTA. These studies aimed to examine the relationship between maturity and cybersecurity outcomes without discussing how maturity affects ZTA deployment and enterprise performance (Ghaffari & Arabsorkhi, 2018). The given research closes that gap by demonstrating that more mature organisations tend to be able to realise and maximise ZTA more successfully, which translates into better results (Nasiruzzaman et al., 2025).

Earlier research by (Bashir, 2024; and Sunkara, 2025) was primarily based on the technical implications of ZTA, including access control, identity verification, and threat prevention. Although they indicated the ability of ZTA to enhance security, they did not refer to organisational aspects that affect the scalability of the framework and its success in the long run. To illustrate, (Mensah, 2024) reported difficulties associated with incorporating ZTA into legacy systems and operational overheads, yet they were also not examined exhaustively regarding organisational maturity. At the same time, this study is concerned that increased cybersecurity infrastructure development and maturity allow organisations to tackle these issues better and scale ZTA easily (Hasan, 2024). Moreover, the results presented in this research can be interpreted within the framework of the Technology-Organisation-Environment model, as these aspects affect the process of innovations adoption, including Zero Trust Architecture (Awa et al., 2017; Malik et al., 2021). According to the TOE framework, the current research reveals that organisational maturity is a key moderating variable for the successful implementation of ZTA. Organisations that have developed security infrastructure can more easily adopt, implement, and scale complex technologies such as ZTA (Brezavšček & Baggia, 2025; Yeoh et al., 2023). This is especially true in the UK, where most organisations upgrade their cybersecurity systems to mitigate the increasing cyber threats. The results are consistent with those of (Ghaffari & Arabsorkhi, 2018), who emphasise that higher cybersecurity maturity can facilitate improved integration of ZTA. Moreover, it is also more directly implied by (Nasiruzzaman et al., 2025; and Liyanage et al., 2024) that the more difficult way of implementing ZTA is as a non-yet-fully-developed organisation, despite the incompatibility problems with the old systems. The results confirm the importance of organisational maturity in optimising the effectiveness of ZTA, which subsequently improves the performance of the enterprise as a whole.

CONCLUSION AND RECOMMENDATIONS

This study adequately establishes the significant moderating role of organisational maturity in the implementation and success of Zero Trust Architecture by UK modern-day enterprises. The study demonstrates that UK organisations with high maturity levels are most likely to adopt ZTA successfully, thus enhancing their cybersecurity position. This study contributes to existing knowledge by bridging the gap between successful adoption of ZTA and organisational maturity, offering valuable insights to both practitioners and scholars. UK SMEs must regularly assess their cybersecurity maturity to detect governance, resources, and infrastructure gaps. This will assist them in knowing they are prepared to adopt more advanced security architectures, such as ZTA, and ensure that their strategy is easy to scale and efficient. The UK NCSC should develop specific support programmes for SMEs to enhance their cybersecurity maturity level. This may involve grants, training, and resources to enable smaller businesses to create the required basis for ZTA implementation so that they are not exposed to increasing cyber threats.

LIMITATIONS

However, there are limitations as the study utilised a convenience sampling method, whose use across all organisational structures and sectors may be limited. The research also addresses the moderating role of organisational maturity without scrutinising the deep-rooted individual factors of maturity, organisational culture, and cybersecurity governance, which may also influence ZTA success. This is also limited to the geographical bounds of the UK; hence, it has limited generalisability.

POLICY RECOMMENDATIONS

Policymakers must focus on creating a conducive environment that contributes to organisational maturity in cybersecurity to increase the success of implementing ZTA. This also involves facilitating the investment in human capital, improving cybersecurity, and developing strategic frameworks for adopting an innovative technology such as ZTA. ZTA must also be part of the mandatory aspect of UK business-related cybersecurity regulations to improve the defences against up-and-coming cyber threats to the industry, particularly those functioning within critical sectors. In addition, policymakers need to encourage UK organisations to review their cybersecurity maturity regularly and provide recommendations to scale up ZTA to deliver continuous growth and reaction to emerging risks.

FUTURE IMPLICATIONS

The future relevance of this study suggests that the companies in the UK that are about to roll out ZTA must focus not only on technical deployment but also on organisational maturity. Since the cyber threats are evolving continuously, more mature organisations will be successful in implementing ZTA and tuning it to their own needs so that they remain resilient in the long run. This research identifies the role of cybersecurity leadership, budgeting, and talent in facilitating ZTA adoption. Moreover, the UK firms can invest in developing their cybersecurity skills and staff competency to extract optimal value from ZTA. Policy makers and organisational leaders also benefit from integrating these results in strategy alignment, sharpening decision-making, and fostering a proactive security climate that facilitates effective handling of threats in the increasingly complex digital landscape.

AUTHOR’S CONTRIBUTIONS

T.S. has contributed to conceptualization, idea generation, problem statement, methodology, results analysis, results interpretation.

AVAILABILITY OF DATA AND MATERIALS

The data will be made available on reasonable request by contacting the corresponding author [T.S.].

FINDING

None.

CONFLICT OF INTEREST

The authors declare no conflicts of interest.

ACKNOWLEDGEMENTS

Declared None.

APPENDIX

Survey Questionnaire

Section A: Demographic Information

1. Gender
   a)   Male
   b)   Female
2. Agea)   20 – 29 years
   b)   30 – 39 years
   c)   40 – 49 years
   d)   50 years and above
3. Education Level
   a)   Undergraduate
   b)   Postgraduate
   c)   Other

Section B: Zero Trust Architecture

Rate the following based on the 5-point scale..

1 = Strongly Agree, 2 = Agree, 3 = Neutral, 4 = Disagree, 5 = Strongly Disagree

Section C: Modern Enterprise Performance

Rate the following based on the 5-point scale.

1 = Strongly Agree, 2 = Agree, 3 = Neutral, 4 = Disagree, 5 = Strongly Disagree

Section D: Organisational Maturity

Rate the following based on the scale described below.

1 = Strongly Agree, 2 = Agree, 3 = Neutral, 4 = Disagree, 5 = Strongly Disagree