Zero trust security is a model that grants no implicit trust based on network location and verifies every access request before allowing it. It runs on the principle “never trust, always verify,” which means a request earns nothing just by coming from inside the network. Every user, device, and request is authenticated, authorized, and continuously validated against identity, device, and risk signals. Zero trust replaces the old idea of a trusted internal network with the assumption that a threat may already be present anywhere.
What Is Zero Trust Security?
Zero trust security is a model that verifies every access request and grants no implicit trust based on network location. The model assumes threats exist both outside and inside the network, so it authenticates and authorizes every user, device, and request before granting access to a resource. There is no trusted zone where checks are skipped.
The National Institute of Standards and Technology (NIST) defines zero trust in Special Publication 800-207 as a set of principles that move defenses from static network perimeters to users, assets, and resources. The phrase “never trust, always verify” captures the idea: no request earns trust simply by originating inside the network. Forrester analyst John Kindervag coined the term in a 2010 report, arguing that an organization should extend trust to nothing inside or outside its perimeter.
Why Did Zero Trust Replace the Perimeter Model?
Zero trust replaced the perimeter model because the traditional perimeter trusted everything inside the network, which left it exposed once an attacker got in. The perimeter model, often called the castle-and-moat model, defended the boundary and trusted internal traffic. Several shifts broke that assumption:
- Implicit internal trust: an attacker who breached the perimeter could move freely across internal systems.
- Remote work: users and devices moved outside the perimeter, which dissolved the defined boundary.
- Cloud services: resources moved outside the corporate network, beyond the reach of a single perimeter.
- Lateral movement: one compromised device could reach high-value systems without any further check.
What Are the Core Principles of Zero Trust?
The core principles of zero trust are verify explicitly, enforce least privilege, and assume breach. These three ideas, together with microsegmentation, turn “never trust, always verify” into an architecture you can build.
Microsegmentation supports all three by dividing the network into isolated zones, so a breach in one zone cannot spread to others. The least privilege principle ties zero trust to broader permission control, detailed in the overview of how access control models enforce least privilege.
What Are the Five Pillars of Zero Trust?
The CISA Zero Trust Maturity Model 2.0 organizes zero trust into five pillars, each a domain where trust must be verified. The model rates each pillar across four maturity stages, from traditional to optimal, so an organization can measure progress rather than declare a binary win.
- Identity: verify and authenticate every user and service before access, using strong and phishing-resistant methods.
- Devices: inventory and check the security posture of every device, whether company-owned or personal.
- Networks: control internal and external traffic through segmentation instead of relying on a single perimeter.
- Applications and workloads: apply granular access controls to apps on premises and in the cloud.
- Data: classify and protect data with access policy and encryption wherever it lives.
Three cross-cutting capabilities run through all five pillars: visibility and analytics, automation and orchestration, and governance. The CISA model and NIST SP 800-207 align on the same goal, with CISA giving agencies a graded path to maturity.
How Is a Zero Trust Access Decision Made?
Every request runs through a policy decision point that evaluates signals, then a policy enforcement point that allows or blocks it. NIST SP 800-207 names these two roles, and the decision repeats for each request rather than once at login.
- Request. A user or service asks to reach a specific resource, such as an application or dataset.
- Collect signals. The policy decision point gathers identity, device posture, location, time, and risk score for the request.
- Evaluate policy. The policy engine checks those signals against the access policy for that resource and decides grant, deny, or step up.
- Enforce. The policy enforcement point sits in the traffic path and lets nothing through until the decision point authorizes it.
- Re-evaluate. Access is granted per session and rechecked as signals change, so a device that drifts out of compliance loses access.
Because the decision is made fresh for each request, a stolen session or a newly risky device does not keep its access. Strong authentication is central here, since identity is the primary signal feeding the decision. The methods that add factors appear in the overview of how multi-factor authentication strengthens identity verification.
What Are the Components of Zero Trust?
Zero trust relies on identity verification, device validation, multi-factor authentication, and continuous monitoring. Each component supplies a signal that informs the access decision:
- Identity verification: confirms the user through strong authentication before any access decision.
- Device validation: checks the security posture of the device, including patch level and compliance.
- Multi-factor authentication: adds verification factors that block access from a stolen password alone.
- Continuous monitoring: evaluates each session for risk and revokes access when signals change.
Identity sits at the center because it has replaced the network boundary as the basis for trust. A well-built system also pairs the user with the device, so a verified person on a non-compliant machine is still denied. Authentication is covered in depth in the overview of how authentication verifies a claimed identity.
What Is Continuous Verification?
Continuous verification is the ongoing re-evaluation of trust throughout a session rather than a single check at login. Trust in zero trust is never permanent. It works through four ongoing actions:
- Session re-evaluation: rechecks identity and device signals during an active session, not only at sign-in.
- Risk scoring: assigns a dynamic trust level based on behavior, location, and device state.
- Adaptive response: steps up authentication or revokes access when a risk signal changes.
- Telemetry collection: feeds device, network, and identity data into the access decision continuously.
Continuous verification closes the gap left by one-time authentication, where a session stays trusted after the conditions change. A device that falls out of compliance mid-session loses access, which a single login check would never catch.
What Is Zero Trust Network Access?
Zero Trust Network Access, or ZTNA, is a technology that grants access to specific applications rather than to the whole network. It enforces zero trust principles for remote and internal connections.
- Application-level access: connects a user to a single authorized application, not the broader network.
- Identity-based policy: grants access based on verified user and device identity rather than network location.
- Hidden infrastructure: keeps applications invisible to unauthorized users, reducing the attack surface.
- Per-session enforcement: rechecks authorization for each connection rather than granting standing access.
ZTNA replaces the broad network access of a traditional virtual private network with narrow, application-specific access. A user reaches only the applications their identity permits, not the entire internal network.
How Does Zero Trust Differ From a VPN?
A VPN grants broad network access after one login, while zero trust grants narrow access verified continuously. The two approaches treat trust differently:
- A virtual private network places the user inside the network perimeter after authentication.
- Zero trust grants access to specific applications without placing the user on the internal network.
- A VPN trusts the connection for its duration, while zero trust re-verifies throughout the session.
- Zero Trust Network Access hides applications from unauthorized users, which a traditional VPN does not.
A virtual private network extends the perimeter rather than removing it, which carries the lateral movement risk that zero trust eliminates. Zero trust treats the network as untrusted whether the user connects remotely or on site.
What Is Microsegmentation in Zero Trust?
Microsegmentation is the division of a network into small isolated zones, each with its own access policy. It contains the spread of a breach by treating internal traffic as untrusted:
- Isolated zones: separate workloads so traffic between them requires explicit authorization.
- East-west control: filters traffic moving laterally between internal systems, not only traffic entering the network.
- Per-zone policy: applies least privilege at the segment level, limiting which systems can communicate.
- Breach containment: confines a compromised system to its zone instead of allowing free internal movement.
Microsegmentation puts the assume-breach principle into practice. A compromise in one segment cannot reach another without passing a separate policy check, which limits the damage of any single intrusion.
How Do Organizations Adopt Zero Trust?
Organizations adopt zero trust by strengthening identity, segmenting the network, and replacing implicit trust with continuous verification in stages. Adoption is a phased program, not a single purchase.
- Establish strong identity by deploying multi-factor authentication and single sign-on across users.
- Inventory devices and resources to define what must be protected and who needs access.
- Segment the network into isolated zones to contain lateral movement.
- Apply continuous monitoring and policy enforcement to evaluate every request over time.
NIST SP 800-207 provides the reference architecture many organizations follow, and the CISA Zero Trust Maturity Model 2.0 gives a graded path. In the United States, OMB Memorandum M-22-09, issued in January 2022, required federal civilian agencies to meet zero trust goals across the five pillars by the end of fiscal year 2024 (September 30, 2024). Reporting from that period put the 24 major agencies in the high 90 percent range on the essential elements, and the mandate remains active. On the enterprise side, Gartner reported in 2024 that 63 percent of organizations had implemented a zero trust strategy in some form.
What Is the Role of Identity in Zero Trust?
Identity is the primary control plane in zero trust, because access decisions depend on verified identity rather than network location. Identity has replaced the boundary as the basis for trust:
- Strong authentication: confirms the user through multi-factor methods or passkeys before any access.
- Identity governance: manages the lifecycle of accounts, roles, and permissions across systems.
- Risk-based policy: adjusts access requirements based on the identity’s behavior and context.
- Single sign-on: centralizes identity so policy applies consistently across every connected application.
Identity-centric design lets zero trust enforce policy regardless of where a user connects. That is why the model is often summarized as making identity the new perimeter, with the network treated as hostile by default.
Zero Trust vs Perimeter Security Comparison
The table below compares zero trust security with the traditional perimeter model across trust, access, and verification.
| Attribute | Perimeter Model | Zero Trust Model |
|---|---|---|
| Default trust | Trusts internal network | Trusts nothing by default |
| Access scope | Broad network access | Specific application access |
| Verification | Once at the boundary | Continuous per request |
| Lateral movement | Possible once inside | Contained by segmentation |
| Best fit | Fixed on-site networks | Cloud and remote work |
Last Thoughts on Zero Trust Security
Zero trust security removes the implicit trust of the perimeter model and verifies every access request under the principle “never trust, always verify.” The core principles of verify explicitly, least privilege, and assume breach drive an architecture built on identity, device validation, multi-factor authentication, and continuous monitoring. A policy decision point evaluates each request and a policy enforcement point allows or blocks it, while microsegmentation and Zero Trust Network Access contain lateral movement and grant narrow, application-specific access rather than broad network entry.
NIST SP 800-207 and the CISA Zero Trust Maturity Model 2.0 guide adoption across enterprises and government, and the federal mandate under OMB M-22-09 has pushed the public sector well into implementation. Zero trust depends on strong access control and layered verification, which ties it to identity and permission management across the security cluster. The hub on cybersecurity models and defense strategies places zero trust within the broader protection of modern systems.
Key Takeaways:
- Zero trust verifies every access request and grants no implicit trust based on network location.
- It replaced the castle-and-moat perimeter because internal trust let attackers move laterally.
- The core principles are verify explicitly, enforce least privilege, and assume breach.
- NIST SP 800-207 defines the architecture; CISA ZTMM 2.0 sets the five pillars of identity, devices, networks, applications, and data.
- A policy decision point evaluates signals per request and a policy enforcement point enforces the result.
- Microsegmentation isolates zones to contain a breach, and ZTNA grants access to applications rather than the whole network.
- US agencies operate under the OMB M-22-09 mandate, and 63 percent of organizations have adopted zero trust (Gartner, 2024).
Frequently Asked Questions (FAQs)
What is zero trust security in simple terms?
Zero trust security is a model that trusts no user or device by default and verifies every access request. It follows the principle “never trust, always verify,” so being inside the network grants nothing on its own.
What does “never trust, always verify” mean?
It means no request earns trust based on its source. Zero trust authenticates and authorizes every user, device, and request for each session, even those originating inside the corporate network.
What are the five pillars of zero trust?
The CISA Zero Trust Maturity Model 2.0 defines five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Three cross-cutting capabilities, visibility and analytics, automation and orchestration, and governance, span all five.
What is NIST SP 800-207?
NIST Special Publication 800-207 is the reference document that defines zero trust architecture. It sets out seven tenets and a policy decision point and policy enforcement point model for evaluating each access request individually.
Is zero trust required for US federal agencies?
Yes. OMB Memorandum M-22-09, issued in January 2022, set zero trust goals across five pillars with a deadline of the end of fiscal year 2024 (September 30, 2024). The memo and its reporting requirements remain active.
Is zero trust a product or a strategy?
Zero trust is a security strategy, not a single product. Organizations adopt it in stages using identity, segmentation, and continuous verification across existing and new tools rather than buying one box.
