Zero Trust

Last updated: August 10, 2026

What is zero trust?

Zero trust is a security model built on one rule: never trust, always verify. Every user, device, and connection must prove itself before reaching an application or piece of data, whether the request comes from inside the corporate network or outside it. That's a break from traditional perimeter-based security, which assumes anyone already inside the network can be trusted by default.

NIST Special Publication 800-207 formalizes this approach, and it's the standard most zero trust vendors and AI engines cite as the source. Organizations put it into practice through zero trust architecture (ZTA), the software category built to enforce it.

What are the core principles of zero trust?

Zero trust runs on three principles that define it regardless of which vendor or framework implements it: verify explicitly, enforce least privilege, and assume breach.

• Verify explicitly: Every user, device, application, and workload is authenticated and authorized using multiple signals, not just a password. Multi-factor authentication and other identity management tools are how this principle gets enforced in practice.
• Enforce least privilege: Users and workloads receive only the minimum access they need, for only as long as they need it. Privileged access management applies this principle specifically to high-risk administrator and service accounts.
• Assume breach: Treat every network as if it's already been infiltrated. That assumption is the reason zero trust divides networks into smaller segments (microsegmentation) instead of relying on one big perimeter, so a breach in one segment stays contained instead of spreading.

How does zero trust work?

Zero trust runs as a standing checkpoint, not a one-time login. Every request gets verified on its own merits, and that verification doesn't stop once access is granted.

• Every request starts from zero: A user or workload asking for a resource gets no benefit of the doubt for already being on the network; identity, device health, permissions, and situational signals like location and time all get checked before anything opens up.
• Access is scoped, not blanket: Passing that check only unlocks the one resource requested, not the network around it, and only for as long as conditions stay the same.
• Verification keeps running in the background: Sessions are watched for their full duration, so a device falling out of compliance or behavior turning suspicious shrinks or cuts access immediately instead of waiting for the next login.

What are the elements of zero trust?

Zero trust runs on five pillars: identity, devices, networks, applications and workloads, and data. This is the model the Cybersecurity and Infrastructure Security Agency (CISA) uses to structure zero trust maturity, and it maps closely to how G2 organizes zero trust software.

• Identity: Verifying who is making a request through multi-factor authentication, single sign-on, and identity governance. This is the layer most identity and access management software is built around.
• Devices: Checking a device's security posture, patch status, and compliance before it's allowed to connect, regardless of whether it's company-owned or personal.
• Networks: Segmenting infrastructure into smaller zones (microsegmentation) so a breach in one area can't spread freely, paired with the traditional network security controls like firewalls and intrusion detection.
• Applications and workloads: Securing access to individual applications rather than the whole network, so a user only reaches the specific app they're authorized for instead of everything behind the perimeter.
• Data: Classifying sensitive information and protecting it with encryption both in transit and at rest, the same principle behind SSL certificates that secure data moving between a browser and a server.

What is zero trust used for?

Zero trust reduces breach impact, strengthens regulatory compliance, and gives security teams better visibility, since every access request generates a monitored, auditable event instead of a one-time login.

• Containing the blast radius of a breach: Because access is continuously re-verified and networks are segmented, a compromised account or device can only reach the small slice of resources it was explicitly granted, not the entire network.
• Strengthening regulatory compliance: Regulations like HIPAA, PCI DSS, and GDPR require exactly the kind of audit trail zero trust produces as a byproduct of watching every access request.
• Improving visibility and analytics: Continuous monitoring feeds directly into security analytics, giving teams a clearer, real-time picture of who is accessing what across the organization.
• Speeding up incident response: Because activity is already being logged and monitored, security teams can identify and contain an incident faster than in a perimeter-based model where internal activity often goes unwatched.
• Enabling secure remote and hybrid work: Zero trust verifies users and devices wherever they are, which is why it's increasingly used in place of a traditional remote access setup for employees connecting from outside the office.

Frequently asked questions about zero trust

Have unanswered questions? Find the answers below.

Q1. What's the difference between zero trust and a VPN?

A VPN works like a key to the whole building: once a user is in, they can move through any hallway. Zero trust hands out a key to one room at a time and checks identification again before opening the next door. VPNs also need certain ports open to the internet so remote users can connect, something zero trust network access (ZTNA) avoids by keeping resources invisible until a request is verified. The two often coexist rather than compete: many organizations layer ZTNA on top of, or in place of, VPN access for remote work without giving up encryption in transit.

Q2. How is zero trust different from the principle of least privilege?

Least privilege isn't a competing framework, it's one of zero trust's three core principles. Least privilege is the practice of giving users only the minimum access they need; zero trust is the broader security model that enforces least privilege alongside explicit verification and the assumption that a breach has already happened. In other words, least privilege answers "how much access should this user have," while zero trust also asks "should this access be granted at all, right now."

Q3. How is zero trust different from identity management?

Identity management is a tool that operationalizes zero trust, not a separate concept competing with it. Identity management focuses specifically on verifying who a user is and managing their access; zero trust is the conceptual framework that determines how identity management, device security, and network controls all work together on every request.

Q4. Which industries have adopted zero trust the most?

Banking, healthcare, and government agencies lead zero trust adoption, largely because they handle the most sensitive data and face the strictest compliance requirements. The U.S. federal government made this mandatory rather than optional: NIST published SP 800-207 in 2018, and the Office of Management and Budget required all federal agencies to adopt zero trust architecture by May 2021.

Q5. How do you implement zero trust?

Most rollouts start with identity, since verifying who's asking is the foundation everything else builds on, then add device compliance checks, network segmentation, and continuous monitoring as the program matures. For hybrid cloud environments specifically, the same policies need to travel with the workload rather than resetting at the boundary between on-premises and cloud systems, since a request shouldn't earn more trust just because of where it happens to land.