Zero trust security is a security model that grants no access based on network location alone. Instead of treating everything inside the corporate network as trusted, it checks each request for access, using who the user is, the health of their device and the context of the request, and then grants only the access needed for that task. The usual summary is “never trust, always verify.” Zero trust is a strategy carried out with many tools, not a single product.
At a glance
- Zero trust removes implicit trust based on network location: being on the office network or VPN is not enough on its own.
- Access decisions use identity, device health and context, and can be rechecked when risk changes, depending on how the controls are set up.
- Users get least privilege: access to specific applications and data, not to whole networks.
- It assumes a breach can happen and aims to limit how far an attacker can move.
- It is implemented in stages with identity, device, network, application and monitoring controls, often partly delivered through SSE or SASE services.
What problem it solves
Traditional security built a strong wall around the office network and trusted whatever was inside it. That worked when staff, servers and applications sat in the same buildings. Today people work from home, applications run in SaaS and public cloud, and contractors and partners need access too. A VPN that puts a remote laptop “inside” the network often gives it reach to far more systems than the user needs.
Attackers exploit that. With one stolen password or one infected laptop, they can use broad network access for lateral movement, moving from system to system until they find valuable data or can deploy ransomware. Zero trust narrows what any single user, device or account can reach, makes each access decision on current information, and records it, so a compromise is more likely to stay small and be spotted.
How it works
Zero trust is usually built in layers, starting with identity.
Identity. An identity provider (IdP) becomes the front door, with single sign-on and multi-factor authentication (MFA), preferably phishing-resistant methods such as passkeys. Conditional access policies decide when to allow, block or ask for more proof. Automated provisioning, for example with SCIM, keeps accounts in step with who actually works there.
Devices. Device posture checks, such as whether the device is managed, encrypted, patched and running endpoint protection, feed into access decisions. Unknown or unhealthy devices get reduced access or none.
Network and applications. Zero trust network access (ZTNA) connects users to specific private applications instead of the whole network. Inside data centers and clouds, network segmentation and microsegmentation, often enforced by firewalls, limit which systems can talk to each other.
Privileged access. Administrator rights are granted just in time and for limited periods rather than held permanently. Fine-grained policies, sometimes using attribute-based access control (ABAC), can tie access to the user’s role, the data’s sensitivity and the situation.
Data and web traffic. A security service edge (SSE) service applies web filtering, SaaS controls and data loss prevention to users wherever they are. A secure access service edge (SASE) service combines those controls with SD-WAN networking.
Monitoring and response. Logs from identity, devices, network and applications go to a security operations team, which can step up authentication, end sessions or isolate devices when something looks wrong.
When it matters for buyers
- When replacing or renewing VPN. It is a natural point to move private application access to ZTNA.
- When cyber insurance renews. Insurers often ask about MFA coverage, privileged access controls and segmentation, which are core zero trust controls.
- After a peer is breached. Boards often ask how far an attacker could get with one stolen account.
- When moving applications to SaaS and cloud. Network-perimeter controls cover less of where work happens.
- When evaluating vendors. Many products are marketed as “zero trust”; map each one to the specific control it provides.
Questions to ask vendors
- Which zero trust controls does your product actually provide, and which do we need from elsewhere?
- How does it integrate with our identity provider and device management tools?
- How are access decisions made, and can they change mid-session when risk changes?
- How do users reach private applications, and what network access do they get beyond those applications?
- What does the user experience look like day to day, and how are prompts kept to a minimum?
- What logs do you provide, and how do they reach our security team or provider?
- What does a phased rollout look like for an organization of our size?
How it differs from Zero Trust Network Access (ZTNA)
Zero trust is the overall security model, covering identity, devices, networks, applications, data and monitoring. Zero trust network access (ZTNA) is one technology that applies the model to a specific job: connecting users to private applications one at a time, after checking identity and device, instead of putting them on the whole network the way a traditional VPN usually does. Buying ZTNA is a common early step, but it doesn’t make an organization zero trust on its own. ZTNA is often delivered as part of an SSE or SASE service; our SASE and access management pages cover the network and identity sides.
Problems this helps with
- Anyone on our VPN can reach far more than they need
- One stolen password could let an attacker roam our network
- Cyber insurer or board asking for our zero trust plan
- Staff, apps and data are everywhere now, not inside the office
