What is Zero Trust?
Zero trust is a security model that removes implicit trust based on network location and requires every request to be authenticated, authorized, and continuously evaluated against policy. Being inside a corporate network confers no privilege by itself. Access decisions consider identity, device state, and context, and grant only the privilege needed for that specific request.
The model responds to the failure of perimeter based security, in which a hardened boundary protected a network whose interior was largely trusted. Once an attacker obtained any foothold inside, moving sideways was cheap. Zero trust treats the internal network as hostile, so each service verifies its callers directly rather than assuming that traffic arriving from inside is legitimate.
Practical implementations combine strong identity for both users and workloads, device posture checks, mutual authentication between services, encryption in transit, fine grained authorization at each resource, and segmentation that limits which services can reach which others. A policy decision point evaluates each request, and enforcement points apply the resulting decision at the resource itself.
Continuous evaluation is what distinguishes the model from a single gate at login. Sessions are reassessed as signals change, so a device falling out of compliance, an anomalous location, or an elevated risk score can shorten or revoke access in the middle of a session. Comprehensive logging of these decisions is required, both for detection and for later investigation.
Zero trust is an architectural direction rather than a checkbox, and organizations implement it in stages, commonly starting with identity and device controls before segmenting internal traffic. It reduces the blast radius of a compromise but does not remove risk, since a valid identity that is misused still satisfies policy. Descriptions of any deployment should be read as statements of maturity.
Key points
- No implicit trust granted by network location.
- Every request authenticated, authorized, and continuously evaluated.
- Combines identity, device posture, and context signals.
- Segmentation limits lateral movement after a compromise.
- A direction of travel rather than a finished state.
In practice
An engineer requests access to a production database from a laptop at home. The gateway checks identity through the identity provider, verifies that the laptop reports current patches and disk encryption, and consults policy, which permits read only access to one schema for a limited window. The session is logged, and access is revoked if the device stops reporting compliance.