Monday.com engineers weigh NIST zero trust for safer SaaS access

Zero trust is no longer a niche security phrase buried in an architecture deck. It is becoming the baseline question enterprise buyers ask before they let a SaaS platform spread from a pilot team into the rest of the company, especially once AI agents can touch real work inside the workspace.

For monday.com, that changes the conversation from “can it do the job?” to “who can do what, from which device, under what conditions, and how is every action checked?” That is the new trust test for platforms that sit at the center of identity, data, and workflow execution.

What zero trust actually means

NIST’s Zero Trust Architecture, published as Special Publication 800-207 on August 10, 2020, is still the clearest plain-English reference point for this shift. In NIST’s framing, zero trust moves defenses away from static network perimeters and toward users, assets, and resources. The old assumption that a request is trustworthy because it came from inside the network is gone.

That matters because NIST says zero trust is designed to prevent data breaches and limit internal lateral movement, the kind of movement attackers use after one account or endpoint is compromised. The model centers on policy engines, policy administrators, and policy enforcement points, and NIST’s planning guidance says an ideal system would re-check authentication and authorization for each unique operation. In other words: trust is not granted once, it is continuously earned.

The paper also makes clear that zero trust is not just a security-team project. NIST says implementation requires input and cooperation from multiple stakeholders across an enterprise, which is a useful reminder for SaaS vendors that product, engineering, operations, security, procurement, and sales all shape whether the model actually works in the real world. The 2020 publication, associated with Scott W. Rose, Oliver Borchert, Stuart Mitchell, and Sean Connelly, turned that idea into a concrete architecture instead of a vague slogan.

The four questions that matter before a rollout expands

If you are a monday.com admin or a procurement team evaluating the platform for broader use, zero trust becomes practical very quickly. The right questions are not abstract. They are about identity, device posture, least privilege, and whether access is re-verified as conditions change.

• Identity: Who is requesting access, and is that identity strong enough to trust?

Single sign-on, multi-factor authentication, and role-based permissions are not side features in a zero-trust model. They are the first line of defense, because a user or agent should never inherit broad access just because it is “inside” the workspace.

• Device posture: What device is making the request, and is it healthy enough to connect?

A valid login from an unmanaged or compromised laptop is not the same as a request from a corporate-managed device with current security controls. Buyers increasingly want assurance that access can be tied to device state, not just to a password.

• Least privilege: Does the user, app, or agent get only what it needs, and no more?

This is where SaaS adoption can either accelerate or stall. If a platform can segment access cleanly, customers are more willing to expand it across departments because they do not have to choose between usability and control.

• Continuous verification: Is access checked once, or checked again when risk changes?

Zero trust assumes context can shift during a session. A good enterprise setup asks whether an operation still makes sense for that identity, device, and role at the moment it happens, not just at sign-in.

That set of questions is shaping product adoption because it determines whether security teams say yes to wider deployment. A platform that can answer them in one admin flow is easier to approve, easier to expand, and easier to defend when someone asks why it belongs in the core workflow stack.

Why monday.com has to treat this as product, not policy

monday.com’s own security posture shows why trust is now part of the product surface. The company says its controls are based on ISO 27001, ISO 27017, ISO 27018, ISO 27032, ISO 27701, SOC 1 Type II, SOC 2 Type II, SOC 3, GDPR, CCPA, and HIPAA. It also says it serves more than 250,000 customers worldwide and hosts service data in AWS data centers in the United States, the European Union, and Australia, with disaster recovery in another AWS region.

The most important detail for enterprise buyers is not just the list of frameworks. monday.com says its security program is based on ISO 27001, reviewed annually, and covers the entire organization and anyone who accesses customer information. That is the kind of operational detail that turns security from a back-office promise into part of the buying decision.

For monday.com employees, especially engineers and product managers, this is where architecture meets go-to-market reality. If trust controls are strong, sales can push into larger accounts with less friction. If they are confusing or fragmented, every expansion conversation becomes a procurement battle, even when the product itself is strong.

AI agents make the zero-trust test sharper

The stakes rise again once AI agents enter the picture. monday.com said its customizable AI agents were officially available to customers on May 14, 2026, and described them as designed to integrate into existing workflows. The company also says external AI agents can manage tasks, update boards, collaborate on projects, and support workflows inside the platform.

That is exactly why zero trust stops being theoretical. If an AI agent can touch boards, tasks, and workflows, the question is no longer whether the agent is useful. It is who connected it, what data it can see, what actions it can take, and how those actions are bounded by policy. monday.com says its hosted MCP server gives AI tools secure access to the workspace and is preinstalled on all accounts, which makes the access model even more central to adoption.

monday.com also says its AI permissions and governance tools are available on the Enterprise plan. From one admin area, customers can manage AI access, review AI credit usage, set usage limits, and control account-wide AI permissions. That is the kind of control enterprise buyers now expect before they let AI move from experimentation to daily work.

The company says its AI agents and connectors are governed through role-based permissions, and that custom agents can use boards, data, docs, workflows, and permissions to analyze and connect signals. In zero-trust terms, that is the right direction: make permissions explicit, keep the action scoped, and give admins a central place to review what is happening.

Why this shapes adoption at monday.com

The deeper shift is that trust is no longer separate from product value. A platform that helps teams move faster while proving that every request, every connector, and every AI action is constrained by policy is easier to sell, easier to expand, and harder to dislodge.

That is the real lesson of NIST’s zero-trust model for monday.com. In a cloud-native, multi-tenant, AI-driven workspace, the question is not whether to trust the network. It is whether each identity, device, and agent deserves access right now. For enterprise software, that is becoming the default expectation, and it is quickly becoming the price of admission.