A large number of legacy systems in the critical infrastructure sector do not support modern identity protocols, and the convergence of OT and IT systems introduces compatibility challenges, making full zero-trust implementation a lengthy migration process.