People before Perimeters: Employee Awareness as the Primary Driver of Zero-Trust Architecture Adoption in Banking

Abstract

Financial institutions face increasing exposure to sophisticated cyber threats, prompting a shift from traditional perimeter-based security toward Zero-Trust Architecture (ZTA), a model built on continuous verification and least-privilege access. Despite growing global adoption, empirical evidence on the determinants of ZTA adoption within African, and more specifically Tanzanian, banking institutions remains scarce. This study examines the factors influencing ZTA adoption at NMB Bank PLC, Tanzania, using an extended Technology–Organization–Environment (TOE) framework augmented with an employee awareness construct. A quantitative, cross-sectional research design was employed, with data collected from 114 respondents and analyzed using multiple regression. Results indicate that technological readiness (β = .224, p = .021) and employee awareness (β = .673, p < .001) significantly and positively influenced ZTA adoption, with awareness emerging as the strongest predictor overall. Organizational factors (β = -.136, p = .343) and environmental/regulatory factors (β = -.009, p = .964) did not show statistically significant effects. These findings suggest that ZTA adoption in this context is currently driven more by human-capital readiness than by institutional or regulatory pressure, extending the TOE framework's applicability while highlighting its limitations for security technologies whose effectiveness depends on continuous human behaviour. The study offers empirical grounding for prioritizing awareness-building initiatives alongside technological investment in similarly positioned financial institutions, and contributes one of the first empirical assessments of ZTA adoption determinants within a Tanzanian banking context.