What is zero trust?

Zero trust operates on the principle of “never trust, always verify” rather than granting implicit trust to all users inside a network. This granular security approach helps address the cybersecurity risks posed by remote work, hybrid cloud services, personally owned devices and other elements of today’s corporate networks.

More and more, organizations are adopting zero trust models to improve their security postures as attack surfaces expand. Evolving legal and regulatory requirements are also driving zero trust adoption. For example, a 2021 executive order from US President Joseph Biden directed all US federal agencies to implement a zero trust architecture (ZTA).

Zero trust strategies are important because the traditional, perimeter-focused model of network security is no longer sufficient for the complex, highly distributed and AI-driven networks that most organizations use today.

For many years, enterprises focused on protecting the perimeters of their networks with firewalls and other security controls. Users inside the network perimeter were considered trustworthy and granted free access to applications, data and resources.

Digital transformation eliminated the traditional concept of a network perimeter. Modern corporate networks extend beyond on-premises locations and network segments. They include cloud environments, mobile services, data centers, IoT devices, software-as-a-service (SaaS) apps and remote access for employees, vendors and business partners. These ecosystems increase the flexibility and scalability of computing networks. They also significantly expand the attack surface, making enterprises more vulnerable to data breaches, ransomware, insider threats and other types of cyberattacks.

Because the network perimeter is no longer a clear, unbroken line, perimeter-based security cannot close every gap. Moreover, threat actors that gain access to a network can take advantage of implicit trust to move laterally through the network and attack critical resources.

In 2010, analyst John Kindervag of Forrester Research introduced the concept of “zero trust” as a framework for protecting enterprise resources through rigorous access control. Zero trust moves the focus away from the network perimeter and puts security controls around individual resources.

Zero trust treats each endpoint, user and connection request as a potential threat to the network. Instead of being given free rein when they pass through the perimeter, users must be authenticated and authorized whenever they connect to a new resource. This continuous verification process helps ensure that only legitimate users can access valuable network assets.

“Never trust, always verify” matters even more when people are no longer the only actors accessing systems.

AI assistants, autonomous agents and model-serving infrastructure living on a network can all request information and execute actions, dramatically increasing the scale and sophistication of authorized activities. But the same expansive potential also applies to cyberattacks.

Zero trust provides a practical framework for harnessing AI tools without trusting AI systems. It helps security teams ensure that retrieval sources are verified and access-controlled; sensitive prompts and outputs are inspected; model integrations are segmented from critical production systems; and high-impact actions require human approval.

As AI blurs the line between user, tool, workload and decision-maker, zero trust imposes limits that let enterprises move quickly while maintaining control over access decisions. 

In the broadest sense, a zero trust security posture works by continuously verifying and authenticating connections between identities, applications, devices and data.

Implementing a zero trust strategy across an organization can be a complex undertaking. It isn’t a matter of installing a single zero trust solution. Rather, zero trust requires planning and careful implementation across a broad range of functional areas, including identity and access policies, security solutions and workflows, automation, operations and network infrastructure.

Many organizations follow specific zero trust frameworks to build zero trust architectures. Established models include Forrester’s Zero Trust framework, the National Institute of Standards and Technology (NIST) Special Publication (SP) 800–207 and the Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model (ZTMM).

While organizations can choose from various frameworks, most zero trust strategies share these key concepts: the three principles of zero trust, the five pillars of zero trust and zero trust network access (ZTNA).

The technical specifications of different frameworks and models can vary, but they all follow a core set of zero trust principles:

• Continuous monitoring and validation
• The principle of least privilege
• Breach assumption

Zero trust makes all network assets inaccessible by default. Users, devices and workloads must pass continuous, contextual authentication and validation to access any resources. And they must pass these checks every time they request a connection.

Dynamic access control policies determine whether to approve requests based on data points such as identity privileges, physical location, device health status, threat intelligence and unusual behavior. Connections are continuously monitored and must be periodically reauthenticated to continue the session.

Least privilege is about narrowing an activity’s blast radius. In a zero trust environment, both users and devices are granted minimal access to resources. This means that identities receive the minimum necessary access (scoped at the application—or even operation—level) to complete a task or fulfill their role. Permissions are revoked when the session ends. Managing permissions in this way limits hackers’ ability to gain access to other areas of the network.

Least-privilege access is enforced through fine-grained policies tied to identity and resource classification. It is often deployed alongside just-in-time access (which grants users and devices access only when they actually need it and only for a short time) and role-based access controls.

Zero trust enterprises operate on the assumption that hackers have already breached network resources, so the mitigation strategies that security teams use to address an ongoing cyberattack become standard operating procedure from the outset. These strategies typically include network segmentation and real-time responses to unusual user or device behavior.

An “assume breach” approach also means implementing mandatory encryption on all data paths, continuous monitoring of device and user behavior and dynamic policy enforcement that can downgrade or revoke access when something looks off.

CISA’s Zero Trust Security Model outlines five pillars that organizations can focus on during a zero trust implementation:

1. Identity
2. Devices
3. Networks
4. Applications and workloads
5. Data

One of the primary technologies for implementing a zero trust strategy is ZTNA. Like a virtual private network (VPN), ZTNA provides remote access to applications and services. Unlike a VPN, however, ZTNA connects users only to the resources they have permission to access, rather than connecting them to the whole network.

ZTNA technologies create one-to-one, least-privilege connections between users and applications, assuming that both outsider and insider threats exist on the network.

In a ZTNA environment, IT and cybersecurity teams create policies that say, “identity A on device B, with security posture C, in context D, can access application E under F and G conditions.” If—and only if—a device adheres to the policy, it is permitted to access the network. ZTNA platforms then establish a brokered, encrypted connection to the specific internal application the identity is allowed to use.

Such granular security policies and controls help ensure that app access stays separate from raw network access and makes access control models portable across on-premises data centers, cloud environments and SaaS apps.

ZTNA is a key part of the secure access service edge (SASE) model, which forms a full edge networking and security fabric that provides direct, secure, low-latency connections between users and resources.

Because a zero trust architecture makes access decisions based on identity, it can offer strong protection for hybrid and multicloud environments. Verified cloud workloads are granted access to critical resources, while unauthorized cloud services and applications are denied.

Regardless of source, location or changes to the IT infrastructure, zero trust can consistently safeguard busy cloud environments.

Enterprises that operate in multiple countries need to control where sensitive data is processed and accessed to meet legal, regulatory and contractual obligations. These requirements often apply to personal information, financial records, healthcare data, government information and intellectual property.

Zero trust helps teams enforce data sovereignty policies wherever data travels. They can classify data by sensitivity and jurisdiction, encrypt it with customer-controlled keys, and apply dynamic access controls based on identity, location and risk.

Zero trust policies can also restrict data processing and replication to approved regions and monitor transfers for signs of unauthorized access or data exfiltration. This helps businesses retain control over sensitive data in geographically dispersed computing environments.

Traditionally, enterprises have relied on VPNs to connect remote workers to network resources. But VPNs don’t scale easily, nor do they prevent lateral movement.

In a zero trust model, businesses can use ZTNA solutions instead. ZTNA verifies employee identities, then grants them access to only the applications, data and services they need to do their jobs.

Privileged accounts can make changes to cloud environments, production applications, security controls and sensitive data. Because these accounts have elevated permissions, they are often valuable targets for cybercriminals.

A zero trust approach requires administrators to verify their identities with strong, phishing-resistant authentication before accessing privileged resources. Organizations can limit access with just-in-time, just-enough permissions to help security teams quickly revoke access when risk increases.

Because IoT devices connect to the internet, they pose a risk to enterprise security. Hackers often target IoT devices to introduce malware to vulnerable network systems.

Zero trust architectures can continuously track the location, status and health of every IoT device across an enterprise and treat each device as a potentially malicious entity. As with other elements of a zero trust environment, IoT devices are subject to access controls, authentication and encrypted communications with other network resources.

Modern applications rely on workloads, services and APIs that constantly communicate across the network. These machine-to-machine (M2M) connections can become attack paths when applications use long-lived credentials or rely on implicit network trust.

Zero trust gives every workload and service a verifiable identity and requires them to authenticate every access request. This approach helps limit the impact of compromised service accounts, cloud roles and API credentials.

AI agents and agentic applications can access data, invoke APIs and take actions across business systems without a person directly initiating every action. As agentic AI tools become more autonomous, businesses will need to manage agent permissions with the same rigor as human users and cloud workloads.

Zero trust treats every AI agent as an NHI with a defined owner, approved purpose and limited scope of access. Teams can issue short-lived runtime credentials, restrict agents to specific tools and data sources, require policy checks before an agent performs sensitive actions, and monitor how agents are using their permissions.

Operational technology (OT) and industrial control systems (ICSs) support critical processes in the manufacturing, energy, transportation and healthcare sectors. These environments often include legacy devices that were not designed for internet connectivity or modern authentication processes.

Zero trust can help businesses reduce risk by segmenting OT environments, limiting communications to approved systems and tightly controlling user access. According to the IDC, nearly 97% of organizations are applying at least one zero trust principle to OT.

Where legacy devices cannot authenticate directly, teams can use gateways and proxies as compensating controls. This approach empowers organizations to be proactive about threat detection while still enabling authorized users to perform necessary work.

Businesses often need to grant network access to vendors, contractors, service providers and other third parties. Hackers can exploit this situation to carry out supply chain attacks, where they use compromised vendor accounts and workloads to break into a company’s network.

Zero trust enables security teams to apply continuous, contextual authentication and least-privilege access to every entity, even those outside the network. These protections prevent attackers from accessing the company’s most sensitive resources, even if they breach a trusted vendor’s account.