Zero Trust

Zero Trust is a security model in which where a request comes from – inside or outside the company network – no longer determines whether it's trusted. Instead, every request is checked individually, whether it comes from an office laptop or a device working from home. The US standards body NIST describes this model in its SP 800-207 document with the principle 'never trust, always verify'.

In practice this means that instead of logging into a VPN once and then moving freely across the whole internal network, a user or device has to prove itself again for every single access to an application. That usually involves several factors, such as a password plus a second proof tied to a device, combined with rules about which device may access which application. Zero Trust is therefore not a single product but a combination of identity verification, device control and fine-grained access rules.

A common misunderstanding is treating Zero Trust as a single product you buy – in reality it's a gradual rework of existing access patterns that's rarely finished overnight. It's equally wrong to assume an internal network no longer needs a firewall as a result; Zero Trust adds to existing protections, it doesn't replace them.