Zero trust is the most heavily marketed term in enterprise security and one of the least precisely used. It is not a product, a protocol or a certification. It is a design principle: never grant access based on network location alone.
What it replaces
The traditional model is perimeter security. A hardened boundary — firewall, VPN — separates a trusted internal network from an untrusted outside. Once inside, systems largely trust each other.
This worked when all employees were in offices and all systems were in data centres. It fails for reasons that are now ordinary: staff work from anywhere, applications run in several clouds, contractors and partners need access, and personal devices connect to corporate resources.
It also fails on its own terms. An attacker who compromises one credential or one laptop is inside the perimeter, and the flat internal network lets them move laterally until they find something valuable. Most significant breaches follow exactly this pattern.
The actual principles
Strip away the marketing and three ideas remain.
Verify explicitly. Every access request is authenticated and authorised using everything available — user identity, device posture, location, behaviour — rather than being trusted because it came from inside the network.
Least privilege. Grant the minimum access needed, for the shortest time needed. This includes just-in-time elevation rather than standing administrative rights.
Assume breach. Design as though an attacker is already inside. Segment the network so lateral movement is hard, encrypt internal traffic, and log everything so you can reconstruct what happened.
What implementation actually involves
Zero trust touches identity, devices, network, applications and data. A complete programme is a multi-year effort in a large organisation. A worthwhile subset is achievable in months.
Identity, first and most important
Everything else depends on knowing who is making a request. The foundations are a single identity provider for all applications, phishing-resistant multi-factor authentication, and the elimination of shared accounts and long-lived credentials.
Phishing resistance matters specifically. SMS and app-based one-time codes are defeated by real-time relay attacks that are now commodity. Hardware keys and passkeys are not.
Device posture
Access decisions should consider whether the device is known, managed, patched and encrypted. This is where many programmes stall, because it requires device management on every endpoint including contractors’ machines.
A pragmatic middle ground is to require managed devices for sensitive applications and allow unmanaged devices for low-risk ones, rather than attempting universal enrolment immediately.
Application access instead of network access
The practical replacement for a VPN is an identity-aware proxy that grants access to specific applications rather than to a network. The user authenticates, policy is evaluated, and they reach one application — not a subnet containing forty.
This is often the single highest-value change, because it removes the flat internal network that makes lateral movement easy.
Microsegmentation
Restricting which services can talk to which, rather than allowing everything inside a VPC to reach everything else. Valuable and labour-intensive. Start with the most sensitive systems — the database holding customer data, the build system — rather than attempting the whole estate.
A realistic order
- Single sign-on everywhere. Every application behind one identity provider, no local accounts.
- Phishing-resistant MFA for all staff, starting with administrators.
- Remove standing admin rights. Just-in-time elevation with approval and logging.
- Replace the VPN for the top five applications with identity-aware access.
- Device posture checks on sensitive applications.
- Segment the crown jewels — the two or three systems whose compromise would be catastrophic.
- Extend outward from there, in priority order.
Steps one to three deliver a large share of the risk reduction and are achievable in a quarter for most mid-sized organisations.
What it costs
Three categories, all real.
Licensing. Identity platforms, device management and access proxies are per-user subscriptions that add up quickly at scale.
Engineering time. Integrating legacy applications with modern identity is the bulk of the work, and some applications simply cannot be integrated without replacement.
User friction. More authentication prompts, more device requirements, more access requests. Badly implemented, this produces workarounds that undermine the whole programme. The mitigation is to tune policy so low-risk access stays frictionless and reserve the friction for genuinely sensitive actions.
Common mistakes
Buying a product and calling it done. No vendor sells zero trust. They sell components of it, and the architecture is yours to design.
Starting with microsegmentation. It is the most visible piece and the hardest. Identity first, always.
Ignoring service-to-service traffic. Machine identities usually outnumber human ones, and API keys sitting in configuration files undo a great deal of careful work on human access.
Treating it as a project with an end date. It is a posture that needs maintaining as applications, people and devices change.
How it relates to compliance
Zero trust is not a compliance framework, but a mature implementation makes most frameworks substantially easier. Access reviews become possible because access is centralised. Audit evidence is produced automatically. The control objectives in SOC 2 around logical access map almost directly onto the first three steps above.
That overlap is worth using when seeking budget: the security case and the commercial case for an audit report are the same investment.
Zero trust for service-to-service traffic
Discussion of zero trust focuses on employees, while in most systems machine identities vastly outnumber human ones. A microservice calling another, a CI job deploying, a scheduled task reading a database — all of these are access requests, and most are authenticated with a static secret sitting in a configuration file.
The equivalent principles apply. Each service should have its own identity rather than sharing one. Credentials should be short-lived and issued dynamically rather than long-lived and copied around. Service-to-service traffic should be authenticated and encrypted, not trusted because it originated inside the cluster. And each service should be authorised for specific operations, not granted broad database access because narrowing it was fiddly.
Service meshes and workload identity systems provide this, as do the cloud providers’ native mechanisms. The hard part, as with human access, is the inventory: knowing every credential that exists and where it lives. That audit is usually where the programme starts and frequently where it discovers something alarming.
Measuring whether it is working
Zero trust programmes run for years, which makes progress measurement important for keeping support. Five metrics work well.
- Share of applications behind single sign-on.
- Share of accounts with phishing-resistant MFA.
- Number of standing privileged accounts, which should trend to near zero.
- Number of long-lived credentials in use, same direction.
- Median time to revoke access after an employee leaves.
Each is countable, each improves visibly, and each maps to a real reduction in risk. Reporting them quarterly keeps the programme funded far better than describing architectural progress.
Frequently asked questions
Does zero trust mean getting rid of the VPN?
Usually yes, over time, replaced by identity-aware application access. Some legacy systems may still require network-level access, which should be tightly scoped rather than left as a general tunnel.
Is zero trust only for large organisations?
No. Small organisations can implement the highest-value elements — SSO, strong MFA, no standing admin rights — faster than large ones, because they have fewer legacy applications.
How long does implementation take?
The foundational identity work takes one to two quarters for a mid-sized organisation. Full microsegmentation and device posture across a large legacy estate is a multi-year programme.
What is the single highest-value step?
Phishing-resistant multi-factor authentication on every account, administrators first. It eliminates the most common initial access vector at modest cost.
