Key Takeaways

  • Mainframe connectivity to cloud services, APIs, and DevSecOps pipelines is expanding the systems’ attack surface.
  • Zero-trust controls can bring resource-level authorization and stronger identity checks to regulated workloads.
  • Security modernization is being constrained by monitoring gaps, scarce skills, and limited adoption of quantum-safe cryptography.

Mainframes remain deeply embedded in banking, government, insurance, and other regulated sectors. Yet the environment around them has changed. IBM Z workloads increasingly exchange data with cloud services, web applications, APIs, identity providers, and automated development pipelines. Those connections support modernization, but they also create more routes through which compromised credentials, malware, insider activity, or vulnerable external components can reach sensitive resources.

According to Planet Mainframe, the 2025 Arcati Mainframe User Survey found that 53% of organizations expressed concern about mainframe security. The survey noted that 21% reported insufficient cybersecurity monitoring, while only 7% had adopted quantum-safe cryptography. Those findings suggest that confidence in the underlying platform does not necessarily extend to every connection, user identity, and security process surrounding it.

Integration requires particular attention. The Arcati Mainframe Market Pulse 2024 found that government and financial-services organizations reported 4.7 times more vulnerabilities when external technologies were integrated with mainframes. That data does not make integration inherently unsafe, but it illustrates how an otherwise tightly managed system can inherit weaknesses from APIs, middleware, cloud accounts, service credentials, and software supply chains.

Traditional perimeter controls struggle when a transaction crosses several environments before reaching a mainframe application. Zero trust approaches the issue differently. Access is evaluated according to identity, device condition, context, policy, and the sensitivity of the requested resource rather than being presumed safe simply because it originated inside a corporate boundary.

NIST SP 800-207, published in 2020, established the foundational Zero Trust Architecture model. It emphasizes ongoing verification, least-privilege access, and resource-level policy decisions. NIST SP 1800-35, published in 2025, adds practical implementation guidance demonstrated across hybrid environments. For mainframe operators, the objective is applying those principles consistently across both legacy workloads and newer systems that interact with them.

Implementation can involve tighter privileged-access governance, shorter-lived credentials, stronger multifactor authentication, encryption, detailed event monitoring, and policy checks close to the data itself. Security platforms from IBM, Broadcom, and BMC already support combinations of these functions, including operational automation and access oversight. The harder task is often coordinating policies and telemetry across products, teams, and computing environments without disrupting high-volume transactions.

Skills represent another bottleneck. A 2025 Kyndryl State of Mainframe Modernization survey of 500 senior leaders found that 70% struggled to find modernization skills. Security was the hardest discipline to hire for, cited by 45%, according to Diginomica. Meanwhile, the Arcati survey found that 49% of organizations reported demand for mainframe security skills. Scarcity can slow policy reviews, identity cleanup, monitoring improvements, and incident-response planning.

Organizations are actively investing to address these gaps. Arcati reported that 35% of organizations had funded mainframe security improvements such as encryption and zero-trust frameworks. Progress typically begins by inventorying privileged identities, mapping application dependencies, consolidating security events, and applying more granular authorization to high-value data to reduce broad standing access.

Quantum readiness adds a longer-term complication. With adoption of quantum-safe cryptography at only 7% in the 2025 survey, many organizations are just beginning to assess which data, keys, certificates, and protocols will require migration. Replacing cryptography across interconnected mainframe and distributed environments takes planning. Organizations that combine crypto inventories with zero-trust programs can address current access risks while preparing for future changes in encryption standards.