The Zero-Trust Paradox: Why Email Whitelists are Undoing Millions in Security Investment

**Executive summary:** The article argues that operational whitelisting in email security creates permanent exceptions that subvert zero‑trust architectures, increasing supply‑chain and executive-targeting risk (e.g., BEC) and producing a false sense of compliance; it recommends applying zero‑trust principles to email trust management—temporary/expiring allowances, documented justification, role-based authority, impact assessment, continuous detection, and regular review—so security teams aren’t forced to choose between business continuity and security.