What Is Zero Trust?

Zero trust is a security model that abandons the old idea of a trusted internal network. Instead of assuming anything inside the perimeter is safe, it verifies every request — checking identity, device, and authorization each time, wherever the request originates. The phrase that captures it is “never trust, always verify.”

Why did the old perimeter model fail?#

The traditional “castle and moat” model trusted everything inside the firewall. That assumption breaks the moment an attacker gets in — through phishing, a stolen VPN credential, or a compromised laptop — because once inside, they inherit the network’s implicit trust and move freely. Remote work, cloud services, and mobile devices dissolved the perimeter entirely. There is no longer a clean inside to trust.

Zero trust responds by making network location irrelevant to trust. Being “on the network” grants nothing; every access is earned per request.

What are the core principles?#

Principle	In practice
Verify explicitly	Authenticate and authorize every request on identity, device, and context
Least privilege	Grant minimal, just-in-time access
Assume breach	Segment, log, and limit blast radius as if attackers are already inside

These directly extend least privilege and defense in depth to a whole architecture.

Zero trust is where fundamentals meet network design — see its networking form in zero trust networking, and the rest of the core ideas at the Security Fundamentals hub.