For decades, enterprise security was a castle. Build a strong wall (the firewall), guard the gate (the VPN), and treat everyone inside as trustworthy. The model even had a name — perimeter security — and it made sense when "inside" meant physical offices with company desktops reaching company servers.
Then every assumption quietly died. Applications moved to the cloud — outside the wall. Staff went remote, on home networks and personal devices — outside the wall. And attackers demonstrated, breach after breach, that once they phished a single employee, being "inside" handed them the run of the castle. The perimeter didn't just weaken; it became actively misleading, because it granted enormous implicit trust based on network location — the one signal attackers had learned to fake most easily.
The inversion
Zero trust is the deliberate inversion of that model, and it fits in one sentence: stop treating network location as evidence of trustworthiness — verify every request as if it arrived from the open internet. No more "you're on the LAN, come on in." Every access to every application gets evaluated: who is this identity, on what device, in what state, asking for what?
In practice, each request is judged on stacked signals:
- Identity — strongly authenticated (MFA), and does this person's role justify this access at all? (Least privilege, from earlier on the trail, is a structural pillar here.)
- Device — is it a managed, healthy machine? Encrypted, patched, endpoint protection running? A valid user on a compromised laptop is not a valid request.
- Context — location, time, behaviour. The same credentials from an unfamiliar country at 3am aren't the same request as from the usual laptop at the usual desk.
- Continuity — and this is the subtle one: verification isn't a door you pass once. Sessions get re-evaluated; a device that falls out of compliance mid-session can lose access mid-session.
If you use a modern workplace, you've already felt zero trust: prompted for MFA on a new device, blocked from email on an unenrolled phone, access to one app but not another. Products like conditional access engines are zero trust's if-this-then-that machinery — this trail has a separate deep-dive on exactly that.
What it is not
Three corrections that separate people who understand zero trust from people who've read a vendor brochure. It is not a product — no box ships "zero trust"; it's an architecture assembled from identity, device management, segmentation, and policy. It does not mean trusting nothing ever — it means trust is earned per-request from evidence, rather than inherited from network position. And it does not abolish firewalls or VPNs overnight — real organisations run hybrid states for years, shrinking the implicitly-trusted zone gradually toward zero.
The deepest way to hold the idea: perimeter security asked "where are you?" Zero trust asks "who are you, on what, doing what, right now?" — and asks it every single time. Everything else is implementation detail.