Zero-trust security is a security architecture and operating model based on the principle that access should not be automatically trusted merely because a user, device or request originates from a particular network, location or organisational environment. The phrase is commonly associated with the principle "never trust, always verify", although a more precise interpretation is that trust should be continuously evaluated and access should be explicitly authorised according to available evidence and policy.
Zero trust treats resources as requiring protection regardless of whether they are inside or outside a traditional corporate network perimeter. Authentication, device posture, resource sensitivity, requested action, user or workload identity and other contextual signals can all contribute to an access decision. Zero trust is therefore broader than a single product, firewall configuration or authentication method.
Traditional perimeter-oriented security often assumed that users and systems inside a protected network could be trusted more than entities outside it. This model became increasingly difficult as organisations adopted cloud services, remote work, mobile devices, software-as-a-service applications and distributed infrastructure. Once an attacker gained a foothold inside a network, broad internal connectivity could allow lateral movement. Zero-trust architecture addresses this problem by reducing implicit trust between network locations and requiring access decisions at the resource or application level. The historical development of zero trust is associated with ideas developed in the late 2000s and early 2010s, including work on de-perimeterisation and the subsequent formalisation of zero-trust principles by organisations such as the US National Institute of Standards and Technology.
Identity is a central component of zero trust. Users, services, applications and devices should have identifiable security principals, and access should be granted according to explicit policy rather than network position. Strong authentication, including MFA and phishing-resistant methods, can establish evidence about user identity. Device-management systems can provide information about whether a device is managed, encrypted, patched or otherwise compliant. Workload identity can allow one service to authenticate to another without relying solely on network location. However, identity alone is insufficient: an authenticated identity can still be compromised, overprivileged or acting outside its authorised purpose. Zero trust therefore combines identity with policy, context, least privilege and continuous monitoring.
Least-privilege access is a major zero-trust principle because users and workloads should receive only the access required for the requested task. A zero-trust system may evaluate the identity of the requester, the resource being accessed, the action requested, the device's security state and other conditions before permitting access. Access can be narrowly scoped and time-limited rather than being a permanent entitlement to an entire network. Microsegmentation can reinforce this architecture by limiting communications among workloads and systems. If one component is compromised, segmentation can reduce the paths available for lateral movement. Zero trust therefore does not mean blocking all access; it means making access conditional, explicit and appropriately constrained.
A zero-trust architecture can include identity providers, endpoint-management systems, policy engines, policy enforcement points, application gateways, network controls, security analytics and logging. A policy engine may evaluate information about a request and determine whether access should be allowed. An enforcement component then implements that decision. In practice, architectures differ substantially because zero trust is an approach rather than a single standard product. Some organisations begin with identity and MFA, others with application segmentation, device posture assessment, workload identity or data protection. A mature implementation generally spans multiple security domains and uses telemetry to make more informed decisions.
Zero trust is sometimes misunderstood as meaning that every user must repeatedly log in before every action. That is not the fundamental requirement. Continuous or adaptive evaluation can occur without forcing users through a visible authentication prompt for every operation. A system might establish a session using strong authentication and then evaluate risk signals, device posture and resource sensitivity when additional access is requested.
Similarly, zero trust does not mean that internal networks are inherently malicious or that perimeter controls are unnecessary. Firewalls, VPNs and network segmentation can still be useful; zero trust changes the assumptions under which these controls operate. The key distinction is between implicit trust based on location and explicit, policy-driven authorisation based on relevant evidence.
Zero trust can improve security in distributed environments by reducing broad implicit access and limiting the potential impact of compromised credentials or devices. It can also improve visibility because access decisions and authentication events can be centrally monitored. However, implementation can be complex. Organisations may have legacy applications that lack modern identity mechanisms, fragmented asset inventories, inconsistent access policies and incomplete telemetry. Poorly designed zero-trust controls can also create operational friction or accidental service dependencies. Migration therefore commonly occurs incrementally, beginning with high-value applications and identities and progressively improving policy, segmentation, device management and monitoring. Zero trust is an architectural transformation rather than a configuration switch.
Zero trust relates closely to authentication, authorisation, least privilege, endpoint security, network security, application security and data protection. Authentication verifies identity, authorisation determines permitted actions, least privilege limits those actions, endpoint controls assess devices, network controls constrain communication, application security protects software and data controls protect information. Zero trust integrates these concepts into an approach that avoids granting broad trust based solely on network position. Its practical objective is to reduce unnecessary access and limit the consequences of compromise. It is therefore best understood as a continuous security model based on explicit verification, narrowly scoped authorisation, contextual policy and monitoring rather than as a synonym for any individual security technology.
