The old security model drew a wall around the corporate network: outside was hostile, inside was trusted. Once you were in — by VPN, by badge, by an attacker's stolen credential — you could reach most things. Zero trust discards that assumption. Every request to every resource is authenticated, authorised and evaluated for risk, regardless of where it comes from. "Never trust, always verify" is the slogan; the substance is an architecture, and it's now the reference model for how security is expected to work.
Why the perimeter stopped working
Three changes made the castle-and-moat model obsolete. Applications moved to the cloud and SaaS, so "inside the network" stopped meaning anything. Workforces went remote and mobile, so users were outside the wall by default. And attackers learned that the easiest path was to become an insider — phish one credential, land on one laptop, then move laterally through a flat internal network where nothing asked questions. Nearly every major breach of the past decade involved that lateral movement. Zero trust exists to stop it.
The principles
NIST's Special Publication 800-207, the most widely referenced definition, reduces to a handful of ideas:
- Verify explicitly. Every access decision uses all available signals — identity, device health, location, the sensitivity of the resource, behaviour — not just a network address.
- Least-privilege access. Users and services get the minimum access needed, for the minimum time, with just-in-time elevation for privileged tasks.
- Assume breach. Design as if an attacker is already inside: segment so they can't move, encrypt so they can't read, log so they can be found.
- Per-session, per-resource decisions. Access to one application doesn't imply access to another. Trust is evaluated continuously, not granted at login.
The pillars of a programme
Most frameworks (CISA's Zero Trust Maturity Model is a common one) organise the work into domains:
- Identity. The foundation. A single identity provider for people and services; phishing-resistant MFA; conditional access policies that consider risk; lifecycle automation so access is removed when roles change.
- Devices. Every device is inventoried and its health (patched, encrypted, EDR running, not jailbroken) is a factor in access decisions. Unmanaged devices get less.
- Networks. Microsegmentation so that workloads can only talk to what they need to; zero-trust network access (ZTNA) replacing the VPN with per-application connections brokered by identity and device posture; encryption of all traffic including internal.
- Applications and workloads. Service-to-service authentication (mutual TLS, workload identities, service meshes); API gateways enforcing policy; secrets managed, not embedded.
- Data. Classification so that sensitive data gets stricter policies; encryption; access logging; data-loss controls.
- Visibility and automation. Telemetry from all of the above feeding analytics that detect anomalies and adjust policies automatically. This is what makes "continuous" evaluation real.
What it looks like in practice
An employee opens the finance application. The request goes to an access broker rather than straight to the app. The broker checks: is this identity valid, with fresh MFA? Is the laptop managed, patched and running endpoint protection? Is the login from a plausible location and time? Does this person's role permit this application? If everything passes, a connection is established to that application only — the user never gets a network route to anything else. If the device fails a health check, access is denied or limited to a read-only view. If behaviour during the session becomes anomalous, the session is re-challenged or cut. The same logic applies between services in a data centre: a web front-end can call the order service and nothing else, authenticated by workload certificate, and that policy is enforced at the network and application layers simultaneously.
A realistic adoption path
Nobody switches to zero trust in one project. The sequence that works:
- Consolidate identity and enforce strong MFA everywhere. This alone eliminates most credential-based attacks.
- Get device inventory and health signals into the identity system so conditional access has something to condition on.
- Replace VPN with ZTNA for the applications remote users access most, one application at a time.
- Segment the crown jewels. Identify the systems whose compromise would be catastrophic and isolate them first, rather than trying to microsegment everything at once.
- Extend to workloads — service identity and mesh policies in cloud and container environments, which are often easier than legacy networks.
- Measure and iterate. Maturity models exist so you can track progress across pillars and justify the next investment.
The common failure is buying a product labelled "zero trust" and declaring victory. It's an architecture and an operating model, and the identity and inventory groundwork is unglamorous but unavoidable.
Where it's going
Zero trust is the assumed baseline in US federal security policy, in frameworks like NIS2 in Europe, and in cyber-insurance requirements. The frontier is extending it to AI agents and automated workloads — non-human identities that now outnumber human ones in most organisations and often hold broad, static permissions — and to operational technology, where decades-old equipment can't authenticate itself and must be wrapped in segmentation instead. The principle doesn't change: no implicit trust, for anyone or anything, anywhere.
- Zero trust replaces network location with identity, device health and context as the basis for every access decision.
- Its purpose is to stop lateral movement — the step in nearly every major breach.
- Start with identity and MFA, then device posture, then ZTNA and segmentation of critical systems.
- It's an architecture and operating model, not a product; non-human identities are the next frontier.