What is Zero Trust?

Traditional security assumed anything inside the corporate network perimeter could be trusted. Zero Trust rejects this, recognizing that attackers can be inside the network via compromised accounts, insider threats, or lateral movement, and that the perimeter itself is dissolving with cloud adoption and remote work.

Implementation involves: strong identity verification (MFA, certificate-based auth, conditional access), device health validation (endpoints must meet security posture requirements), network microsegmentation (communication limited to what is required), application-layer access control (per-application proxies replacing broad VPN access), and continuous monitoring (logging all access, detecting behavioral anomalies).

NIST SP 800-207 defines the Zero Trust Architecture standard, breaking the model into three logical components: a policy engine that evaluates trust signals and decides whether to grant access, a policy administrator that establishes or terminates the connection, and a policy enforcement point that sits inline on every request. Every access decision recalculates trust in real time rather than granting a session-long pass after initial login. Signals feeding the policy engine include device compliance state, user risk score, time of day, geolocation, and the sensitivity of the resource being requested.

A practical example: an engineer's laptop authenticates with MFA and a valid certificate, but endpoint management flagged it days earlier for an out-of-date patch level. Under a perimeter model the laptop still gets full VPN access. Under Zero Trust, the policy engine downgrades its risk score and the ZTNA proxy denies access to the production database tier while still permitting access to low-sensitivity resources like an internal wiki.

Microsegmentation is the network-layer mechanism: instead of one flat internal network, workloads are grouped into small segments with explicit allow-listed communication paths, usually enforced through software-defined networking or host-based firewalls rather than physical boundaries. A compromised web server cannot simply scan and connect to a finance database unless that specific path is explicitly permitted.

ZTNA products replace traditional VPNs by brokering per-application access instead of granting broad network-level connectivity. Implementation is a journey rather than a product purchase, and vendors implement Zero Trust unevenly: some enforce only identity-based access without device posture checks, which is a partial implementation, not the full model.