What Is a Zero Trust Network?
A zero trust network removes implicit trust from the network itself. Where the old model trusted anything inside the perimeter, zero trust verifies every access request on its own merits — identity, device health, context — no matter where it comes from. It is the network expression of the zero trust principle: being “on the network” grants nothing.
Why replace the perimeter model?#
Because the perimeter dissolved and, when breached, offered no interior defense. The classic “castle and moat” trusted the internal network, so one compromised device could move freely across it. Remote work, cloud, and mobile erased any clean inside. Zero trust responds by making location irrelevant:
| Perimeter model | Zero trust network |
|---|---|
| Trust the internal network | Trust nothing implicitly |
| One breach reaches everything | Every hop re-verified |
| Location grants access | Identity + context grant access |
This directly counters lateral movement — the phase where an intruder spreads internally — because there is no trusted interior to spread through.
What does it take to adopt?#
Zero trust networking is built from familiar parts, applied pervasively:
- Strong identity and MFA on every access.
- Device posture checks via NAC.
- Microsegmentation so workloads are isolated by default.
- Per-request authorization and thorough logging.
Zero trust networking is the modern successor to the perimeter. More at the Network Security hub.
Frequently asked questions#
What is a zero trust network?
A zero trust network removes the assumption that being inside the network means being trusted. Instead of a trusted internal zone behind a perimeter, every access request is authenticated, authorized, and verified based on identity, device posture, and context — regardless of where it originates. Network location no longer grants any privilege.
How is zero trust networking implemented?
Through strong identity and MFA, device posture checks, microsegmentation so workloads cannot freely talk, per-request authorization, and pervasive logging. It is adopted incrementally — usually starting with identity and access, then segmentation — rather than as a single product you install. The mantra is "never trust, always verify."