What is Zero Trust
Zero trust is a security model where every connection is verified regardless of where it originates — there is no trusted network perimeter. A request from inside the corporate network is treated with the same suspicion as one from the public internet.
What did it replace?
The traditional model is perimeter security: put a firewall around the corporate network, and trust everything inside. Once you're past the VPN, you can access internal services freely. This worked when employees sat in offices and servers lived in on-premise data centers.
It stopped working when applications moved to the cloud, employees started working from home, and attackers realized that compromising a single device inside the perimeter gave them access to everything.
How does zero trust work?
Zero trust enforces verification at every layer:
- Identity verification — every request must prove who is making it, usually with short-lived certificates or tokens.
- Device verification — the device itself must be authorized, patched, and compliant.
- Per-request authorization — each request is evaluated against access policies. Being authenticated doesn't mean being authorized for everything.
- Encryption everywhere — all traffic is encrypted, even between services in the same data center. WireGuard and mutual TLS are common implementations.
What does it look like in practice?
Instead of a VPN that grants broad network access, zero trust uses identity-aware proxies. An employee accessing an internal tool connects through a proxy that checks their identity, device posture, and permissions for that specific application. No network-level access is granted — the user can reach only the applications they're authorized for.
Google's BeyondCorp was one of the first large-scale implementations, eliminating the corporate VPN entirely.
Why it matters
Zero trust is the dominant security architecture for modern infrastructure. As networks become more distributed — multi-cloud, remote work, edge computing — the idea of a trusted perimeter is obsolete. Every connection must earn trust individually.