Zero Trust.

From perimeter trust to per-request verification

The traditional model treated the corporate network as a trusted zone. Get inside the firewall, through the VPN, behind the perimeter, and you were implicitly trusted to move laterally. Zero Trust rejects that assumption. There is no trusted interior. A request from a laptop on the office LAN is treated with the same suspicion as a request from a coffee shop, because location no longer earns trust. Every access decision is made fresh: who is asking, on what device, with what posture, for which resource, in what context, and is that combination authorised right now.

This matters because the perimeter dissolved in practice years ago. Staff work from home, applications live in someone else SaaS, and a single phished credential used to mean free movement across the whole estate. Zero Trust shrinks that blast radius. The attacker who steals a password still faces device checks, continuous authorisation, and segmentation at every hop, so one compromise no longer cascades into a full breach.

What practitioners actually build

Read past the vendor pitch decks. Zero Trust is an architecture and an operating model, not a box you buy. NIST SP 800-207 describes it in terms of a policy engine that makes decisions, a policy administrator that enforces them, and policy enforcement points that sit in front of resources. The practical work is making identity the control plane and verifying every request against policy. The recurring building blocks are:

• Strong identity and authentication, with MFA as the baseline rather than an add-on, so the identity making a request is genuinely verified.
• Device posture and health, because a verified user on a compromised or unmanaged device is still a risk worth scoring.
• Least privilege and just-in-time access, granting the narrowest rights needed and removing standing access that attackers love to inherit.
• Micro-segmentation, so a foothold in one workload does not open a flat path to everything else.
• Continuous evaluation and logging, because trust is reassessed as context changes, not granted once at login and forgotten.

How it differs from neighbouring ideas

Zero Trust is easy to confuse with the principles it builds on. Least privilege is one ingredient: it limits what an identity can reach, but on its own it still assumes the network is trusted. Defense in depth is the older, broader instinct of layering independent controls; Zero Trust is a specific way to remove the soft, trusted interior that classic layered defenses often left in place. Identity and access management provides the machinery, the directories, authentication and authorisation, that Zero Trust uses as its foundation. The shorthand is that IAM and MFA and least privilege are components, while Zero Trust is the design philosophy that orchestrates them into continuous, contextual verification.

In the standards and policy landscape the idea is now mainstream. NIST SP 800-207 is the reference definition, and NIST has published companion implementation guidance. Government mandates in the United States have pushed agencies toward Zero Trust architectures, and European bodies such as ENISA reference it as a direction of travel for resilient, identity-centric security. Auditors increasingly expect to see the principles reflected in access design, even where a framework does not name Zero Trust outright.