Zero trust security
Also known as: zero trust, ZTA, never trust always verify, zero trust architecture
Zero trust is a security model summed up as 'never trust, always verify.' Instead of assuming anyone inside the network is safe, it verifies every user and device for every access request and grants only the minimum needed.
This contains breaches by preventing attackers from roaming freely once they're in.
Zero trust security, explained at three levels
At home
Older networks worked like a castle: once you crossed the drawbridge, you could wander every room. Zero trust works like a modern hospital, where your badge is checked at every ward, lab, and pharmacy door, and only opens the ones your job needs. Each time you or your device asks for something, the system checks who you are, what device you're on, and whether the request makes sense.
At work
Zero trust is a security model that grants no automatic trust based on network location. Every request to an app or file is checked against the user's identity, device health, and context, and access is limited to what the role needs. For a business, this means a stolen password or infected laptop reaches only a small slice of systems instead of the whole network.
At home
Zero trust rests on three principles. Verify explicitly: check identity, device, and location on every request, not just once at login. Use least privilege: give each account only the access it needs. Assume breach: design as though an attacker is already inside, so damage is contained. At home, the same thinking shows up when your email asks for MFA on a new laptop, or your bank flags a login from another country.
At work
In practice, a small business builds zero trust from parts it may already own. The identity provider, such as Microsoft Entra ID, handles MFA and conditional access. Device management, such as Intune, reports whether a laptop is encrypted and patched. Zero trust network access (ZTNA) replaces the broad VPN with per-app connections. Permissions are reviewed so staff reach only the folders and apps their role requires.
At home
The engine of zero trust is a policy decision point that scores each request in real time. It combines signals, such as sign-in risk, device compliance, location, and the sensitivity of the resource, then allows, challenges, or blocks. Micro-segmentation applies the same idea between servers. While full zero trust is a long journey, in my view MFA plus device checks already captures most of its value for a small office.
At work
NIST SP 800-207 defines the reference architecture: a policy engine and policy administrator make decisions, and policy enforcement points sit in front of each resource. CISA's Zero Trust Maturity Model scores progress across identity, devices, networks, applications, and data. Common failure modes include legacy apps that can't use modern authentication, exceptions that become permanent, and over-reliance on one vendor. Practical rollouts start with identity and devices, then shrink VPN access app by app.
Real-world examples
At home
Sophie's consultancy moved to conditional access: logins from her managed laptop go through smoothly, but an attempt from an unknown device triggers extra verification and blocks access to sensitive files. A stolen password alone no longer opens the door.
At work
Jerome's clinic replaced its all-or-nothing VPN with zero trust network access. Staff reach only the specific applications their role needs, each checked for identity and device compliance, so a compromised laptop can't be used to scan the whole internal network.
How it compares
| feature | Traditional (perimeter) | Zero trust |
|---|---|---|
| Core assumption | Inside = trusted | Trust nothing by default |
| Verification | Once, at login | Continuously, per request |
| Access scope | Broad once inside | Least privilege, per resource |
| Breach containment | Attacker moves freely | Movement blocked/limited |
| Fits remote work | Poorly | Designed for it |
For analysts
You don't buy zero trust off a shelf; you build toward it. For a small business, the highest-impact first steps are MFA everywhere, least-privilege permissions, and conditional access based on device health.
History & origin
The traditional 'castle and moat' model trusted anyone inside the network perimeter, a fatal flaw once attackers breached the wall or employees worked remotely. The zero trust concept was formalized around 2010 and gained urgency with cloud adoption and remote work, which erased the clear perimeter. Government mandates and high-profile breaches pushed it from buzzword to mainstream architecture in the 2020s.