Zero Trust

What is zero trust?

Zero trust is a security model — not a single product — that removes the assumption that anything inside a corporate network can be trusted. Traditional security treated the network like a building with a locked front door: once you were inside, you could move around freely. Zero trust replaces that assumption with continuous verification of every access request, no matter where it comes from or who appears to be making it.

A zero trust approach typically includes:

• Continuous verification of identity — Every user and service must prove who they are for each access request, not just once at login.
• Device trust and posture checks — The health and compliance state of the device making a request factors into whether access is granted.
• Least-privilege access — Users and devices receive access only to the specific resources they need, not broad network access.
• Microsegmentation — Resources are isolated from one another so that compromising one system does not expose others.
• Assume-breach thinking — Architecture and monitoring are designed on the assumption that an attacker may already be present.
• Continuous monitoring and re-evaluation — Trust is never permanent; access decisions are revisited as context changes.

How zero trust works

Zero trust works by moving the access decision away from network location and toward identity, device state, and context. Instead of asking "is this request coming from inside the network?", a zero trust architecture asks "should this specific user, on this specific device, in this specific context, have access to this specific resource right now?"

Verification signals

Every access request is evaluated against multiple signals before it is granted. Common signals include the user's identity and authentication strength, the device's compliance and security posture, the sensitivity of the resource being requested, the user's location and behavior patterns, and the time and manner of the request. Weak or missing signals can trigger step-up authentication, restricted access, or denial.

Policy decision and enforcement

Zero trust architectures generally separate the policy decision point — the engine that evaluates signals against policy — from policy enforcement points that sit in front of applications, networks, and data. When a request arrives, the enforcement point consults the decision engine, which grants, limits, or denies access. This is the mechanism behind conditional access: access is conditioned on verifiable, current facts rather than assumed trust.

Least privilege and microsegmentation

Once access is granted, it is scoped narrowly. Rather than placing a user on the network where they can reach anything routable, zero trust grants access to individual applications or resources. Microsegmentation divides the environment into small zones so that even a successful compromise is contained, limiting an attacker's ability to move laterally toward higher-value targets.

Continuous evaluation

Trust in a zero trust model is never a one-time event. If a device falls out of compliance mid-session, if a credential shows signs of theft, or if behavior deviates from normal patterns, access can be reduced or revoked in real time. This continuous loop — verify, grant narrowly, monitor, re-verify — is what distinguishes zero trust from models that authenticate once and trust indefinitely.

Zero trust vs. traditional perimeter security

Zero trust emerged as a response to the limits of perimeter-based security. The perimeter model — firewalls at the network edge, VPNs to extend the network to remote users — assumed that threats came from outside and that everything inside was safe. That assumption broke down as work moved to cloud applications, personal and mobile devices, and distributed locations, and as attackers increasingly entered through stolen credentials rather than through the firewall.

The perimeter model is not inherently useless — many organizations still run VPNs for specific purposes — but it was designed for a world where users, devices, applications, and data all lived inside one network boundary. Zero trust is designed for the world where they do not.

Key capabilities of zero trust

Because zero trust is a model rather than a product, it is implemented through a set of coordinated capabilities:

• Strong identity and access management. Verified identity is the foundation of every zero trust decision. This typically includes multi-factor authentication, SSO, and identity federation across applications, which also reduces exposure to credential theft.
• Device trust and endpoint compliance. The device making a request must be known, managed or assessed, and in a healthy state. Endpoint compliance checks — encryption status, OS version, patch level, presence of security tooling — feed directly into access decisions.
• Contextual, policy-based access control. Policies combine identity, device, location, application sensitivity, and risk signals to grant, limit, or deny access dynamically rather than statically.
• Microsegmentation and least-privilege networking. Network and application segmentation limits what any single identity or device can reach, containing the impact of a compromise.
• Continuous monitoring and analytics. Telemetry from users, devices, networks, and applications is analyzed continuously to detect anomalies and trigger policy responses.
• Automated response and remediation. When risk is detected — a non-compliant device, an anomalous login — automated actions such as step-up authentication, session restriction, or access revocation apply the policy without waiting for manual intervention.

Benefits of zero trust

Organizations adopt zero trust for outcomes that perimeter-based models struggle to deliver:

• Reduced attack surface. Applications are not exposed to the open network, and broad network access is replaced with narrowly scoped, per-resource access.
• Contained breaches. Least privilege and microsegmentation limit lateral movement, so a single compromised account or device is less likely to become a full-scale incident.
• Better support for hybrid and remote work. Because trust is based on identity and device state rather than network location, employees can work securely from any location, including on bring-your-own-device programs where appropriate controls are in place.
• Consistent policy across environments. The same access logic can apply to on-premises applications, cloud services, and virtual desktops, reducing gaps between environments.
• Improved visibility. Continuous verification generates continuous telemetry, giving security teams a clearer picture of who is accessing what, from where, and on which devices.
• Support for compliance efforts. Organizations subject to applicable data protection or sector-specific frameworks, depending on jurisdiction and data type, often find that zero trust controls such as least privilege and continuous monitoring align with common audit expectations.

What to evaluate in a zero trust solution

No single tool delivers zero trust on its own, and vendor claims vary widely. When evaluating technologies to support a zero trust strategy, organizations typically assess:

• Identity integration. Does the solution work with your existing identity providers and support multi-factor authentication, SSO, and risk-based authentication?
• Device trust signals. Can it evaluate device posture and compliance — across desktop and mobile platforms — as a condition of access, and integrate with your endpoint management tooling?
• Policy granularity and flexibility. Can policies combine identity, device, application, location, and risk context, and can they apply different responses (allow, limit, step up, deny) rather than binary decisions?
• Application coverage. Does it protect the full range of applications you run — web, native, virtual, and legacy — or only a subset?
• Continuous evaluation. Does verification happen per session and in response to changing conditions, or only at initial login?
• User experience. Zero trust that adds constant friction gets worked around. Look for approaches that make secure access seamless for compliant users and reserve friction for genuinely risky requests.
• Interoperability and telemetry. Can it share signals with your security analytics, endpoint, and network tooling so decisions reflect the fullest available context?

Because zero trust is an incremental journey rather than a single deployment, solutions should also support phased adoption — protecting high-value applications first and expanding coverage over time.

Zero trust in practice: industry use cases

Healthcare. Clinical staff move between shared workstations, mobile devices, and patient-area terminals throughout a shift. Zero trust lets healthcare organizations verify each clinician and device at every access point, granting fast access to clinical applications on compliant devices while keeping sensitive records segmented from general network traffic.

Financial services. Financial institutions often face persistent credential-based attacks against high-value systems. Zero trust controls — strong authentication, least-privilege access to trading and core banking applications, and continuous session monitoring — reduce the blast radius of any single compromised account and support the audit visibility these organizations often require.

Retail and frontline operations. Distributed store locations, shared devices, and seasonal staff make perimeter models impractical in retail. A zero trust approach verifies each worker and device per request, so a shared handheld in one store can access inventory systems without granting broad network access, and departing seasonal workers lose access cleanly.

Education. Universities and school systems operate open, heavily BYOD environments that have rarely had a meaningful perimeter. Zero trust lets them protect administrative systems, research data, and student records with per-application access decisions while keeping general connectivity open for the campus community.

Related terms

• Conditional access — The enforcement pattern at the heart of zero trust: access to a resource is granted only when defined conditions about the user, device, and context are met at the time of the request.
• Endpoint compliance — The practice of continuously verifying that devices meet security requirements. Compliance state is one of the primary device trust signals a zero trust policy engine consumes.
• Unified endpoint management — The management layer that enrolls, configures, and monitors devices across platforms. UEM supplies much of the device identity and posture data that zero trust decisions depend on.
• Credential theft — A leading attack vector that zero trust is designed to blunt. Because stolen credentials alone typically do not satisfy device, context, and behavior checks, zero trust reduces the value of a stolen password.
• Mobile threat defense — Threat detection for mobile endpoints. MTD risk signals can feed zero trust policies so that a device showing signs of compromise loses access automatically.
• Zero trust network access (ZTNA) [PROPOSED — no page exists; flagged as a possible calendar gap] — A category of technology that applies zero trust principles specifically to remote application access, commonly positioned as a successor to VPN-based remote access.

Keep exploring

Zero trust touches nearly every layer of how users and devices reach corporate resources. To build on the concepts covered here, explore related glossary topics such as conditional access, endpoint compliance, and unified endpoint management.