Zero Trust
Zero Trust Security Model
"Never trust, always verify." Zero Trust throws out the idea that anything inside the network is automatically safe, and checks every user and device on every request — the model behind modern remote-access security.
Zero Trust is a security model built on a single principle: never trust, always verify. Every user and device must be authenticated, authorised, and continuously validated for each request — and crucially, this applies whether they are inside or outside the network. Sitting on the office LAN, or even being connected through a VPN, grants no automatic access. Identity and device health do.
The model it replaced
The old approach was "castle-and-moat": a strong firewall perimeter guarded the boundary, and anything inside was largely trusted. The flaw is obvious in hindsight — once an attacker (or a compromised laptop) got past the wall, the flat internal trust let them move freely from system to system. Remote work, cloud apps, and mobile devices then dissolved the perimeter entirely: there is no longer a single clean "inside" to defend.
| Castle-and-moat | Zero Trust | |
|---|---|---|
| Trust basis | Network location ("inside = safe") | Verified identity + device posture |
| Access scope | Broad once inside | Per-application, least-privilege |
| Assumption | Perimeter keeps attackers out | Assume breach; verify everything |
The core principles
- Verify explicitly: authenticate and authorise every request using identity, device health, and context (location, time, risk signals).
- Least privilege: grant the minimum access needed, for the specific app, for the shortest time.
- Assume breach: design as if attackers are already inside — segment the network so a single compromise cannot spread laterally.
Zero Trust vs the VPN
A traditional VPN drops you "inside" the network, often with broad reach. Its modern Zero Trust replacement, ZTNA (Zero Trust Network Access), instead brokers access to individual applications based on who you are and the state of your device — so a stolen credential or infected machine cannot wander the whole network. Many organisations are moving from VPNs to ZTNA, frequently delivered as part of a cloud-based SD-WAN or SASE platform that combines networking and security.
Why it matters beyond the enterprise
Zero Trust is primarily an organisational model, but its ideas increasingly shape consumer security too: multi-factor authentication, per-app permissions, and device-health checks are all Zero Trust principles in everyday clothing. Understanding the term explains the direction of modern security — away from trusting a network boundary and toward verifying identity and device on every interaction. It is less a single product than a strategy, which is why it shows up as a buzzword across very different tools.