For decades, cybersecurity was organised around a metaphor: the castle and the moat. The premise was that a network had a trusted inside and an untrusted outside, and that the job of security was to protect the perimeter. Firewalls, VPNs, and intrusion detection formed the walls. Once inside, users and systems were assumed to be safe.
That model is now widely understood to be broken. The moment employees began working from home, applications moved to the cloud, and partners connected to corporate systems from outside, the perimeter evaporated. Attackers who get inside — through phishing, a compromised account, or a malicious insider — face little resistance in a perimeter-based world. The answer is a different philosophy: zero trust.
What Zero Trust Means
Zero trust is not a single product; it is a set of principles. The core assumption is stark: trust nothing, verify everything. No user, device, or workload is trusted by default, regardless of whether it is inside or outside the network. Every access request is authenticated, authorised, and continuously validated.
The principles, as articulated by the U.S. National Institute of Standards and Technology (NIST) in Special Publication 800-207 (2020), include:
- Continuous verification: Trust is never granted permanently; it is re-evaluated constantly, based on signals such as device posture, location, behaviour, and threat intelligence.
- Least privilege: Users and systems get only the access they need, for only as long as they need it.
- Assume breach: Design as though the network is already compromised; segment systems and restrict lateral movement so a breach in one area does not spread.
- Micro-segmentation: Dividing the network into small, isolated segments with individual access controls.
Critically, zero trust explicitly rejects trust based solely on network location. Being on the corporate VPN does not make a device trustworthy.
The Government Mandate
Zero trust moved from academic concept to policy imperative in the wake of high-profile breaches, notably the SolarWinds attack discovered in late 2020. In May 2021, President Biden issued Executive Order 14028, “Improving the Nation’s Cybersecurity,” which directed federal agencies to adopt a zero-trust architecture. This was followed by a 2022 White House memorandum requiring agencies to meet specific zero-trust goals by the end of fiscal year 2024.
The Cybersecurity and Infrastructure Security Agency (CISA) developed a Zero Trust Maturity Model, laying out a progression from traditional to “optimal” zero-trust across five pillars: identity, devices, networks, applications and workloads, and data. The mandate made the U.S. federal government arguably the largest single driver of zero-trust adoption in the world.
The practical target was ambitious and only partially met: agencies were expected to use phishing-resistant multifactor authentication, encrypt traffic, and implement least-privilege access. By the 2024 deadline, progress was mixed — some agencies met most goals, others lagged — but the mandate forced a decade of security modernisation into a three-year sprint.
Who Else Followed
The private sector followed for reasons of both compliance and self-interest. Companies doing business with the U.S. government face contractual requirements that increasingly reference zero-trust principles. Cyber insurers began asking about identity controls and network segmentation. And the general migration to cloud and remote work made the perimeter model untenable on its own merits.
Vendors built entire product categories around zero trust. The most visible is Zero Trust Network Access (ZTNA), which replaces broad VPN access with per-application access brokered by an identity-aware proxy. Zscaler, Cloudflare, and Palo Alto Networks built large ZTNA businesses. Identity providers — Okta, Microsoft Entra ID, Ping — became the new centre of gravity, since identity is the new perimeter in a zero-trust world.
The Building Blocks
Implementing zero trust is less about buying one product and more about assembling several capabilities:
- Strong identity and MFA: Phishing-resistant authentication (passkeys, FIDO2 hardware keys) is foundational.
- Device trust: Assessing device health and compliance before granting access (often via endpoint detection and MDM).
- Contextual access policies: Granting access based on who, what, where, and the risk of the request, not just credentials.
- Micro-segmentation: Isolating workloads so a breach cannot move laterally.
- Encryption everywhere: Protecting data in transit and at rest.
- Continuous monitoring: Detecting anomalies and revoking access when risk rises.
Challenges and Misconceptions
Zero trust is not a quick fix. Legacy systems that cannot do modern authentication, operational complexity, and the sheer scale of inventorying every user, device, and application make full implementation a multi-year effort. Some organisations adopt the label while retaining perimeter assumptions — “zero trust” in name only. And a common misconception is that zero trust is a product you can buy; in reality, it is an architecture and a discipline.
There is also a legitimate tension between security and usability. Overly aggressive continuous verification can frustrate users; under-aggressive verification defeats the purpose. The art is in tuning policies to risk.
Identity: The New Perimeter
At the heart of zero trust is the recognition that identity is the entry point to everything. Traditional perimeters protected networks; in a zero-trust world, protecting identities — user identities, service identities, machine identities — is the primary task. Identity providers (Okta, Microsoft, Ping) have become infrastructure as critical as a firewall once was. Strong, phishing-resistant multifactor authentication — passkeys, FIDO2 hardware keys — is the baseline, not a bonus. Identity is the single most important control surface in a zero-trust architecture, and managing it at scale is one of the hardest operational challenges organisations face.
Network Micro-Segmentation in Practice
Micro-segmentation — dividing the network into small, isolated segments — sounds clean in theory but is messy in practice. Legacy applications often communicate on undocumented ports. Third-party devices require access patterns that break clean segment boundaries. Retrofitting segmentation onto an existing network can cause outages, and many organisations defer it until a maintenance window that never comes. The pragmatic approach is to start with crown jewels — the most sensitive systems — and segment them first, then expand outward. Full micro-segmentation is an aspiration; partial segmentation that protects what matters most is achievable and valuable.
Data-Centric Zero Trust
A gap in many implementations is data. Zero-trust networks and identity controls protect access, but they often stop short of protecting data itself: classification, labelling, rights management, and encryption at the data layer. The ideal zero-trust posture includes data controls that travel with the data — so that even if a document is copied to an unmanaged device, it remains encrypted and access-controlled. Tools for information rights management exist (Microsoft Purview, various DLP suites) but add operational friction. The data layer is, in many organisations, the least mature and most important remaining frontier of zero trust.
The Security Operations Centre and Zero Trust
Zero trust changes the role of the security operations centre. In a perimeter world, SOC analysts trusted internal traffic and focused on external threats. In a zero-trust world, every access event is potentially suspicious, and the volume of signals — identity authentications, device posture changes, access denials — is enormous. Security information and event management (SIEM) platforms are strained by the volume, and the promise of extended detection and response (XDR) is to correlate signals across silos. The SOC must shift from an external-threat focus to a continuous-insider-and-compromised-account monitoring model, which is both more important and more difficult.
Zero Trust as Culture
Implementing zero trust is ultimately a human change. It means telling executives they no longer have implied trust, requiring developers to authenticate every service call, and retraining IT staff who spent their careers building perimeters. Resistance is predictable. The organisations that succeed treat zero trust as a multi-year programme with executive sponsorship, not as a tool acquisition. Communication, incremental wins, and demonstrable risk reduction are essential. Technology is necessary but insufficient; without culture and process change, zero trust is a label, not a reality.
Metrics and the Measurement Problem
Zero trust is easy to profess and hard to prove. How does an organisation know its architecture is actually zero trust rather than zero trust in name? The answer lies in metrics: the percentage of access requests subject to policy, the coverage of phishing-resistant authentication, the number of segments, the mean time to detect and respond, and the share of workloads with enforced least privilege. CISA’s maturity model provides a framework, but measuring abstract posture remains difficult. Vendors, unsurprisingly, market their products as essential and their own dashboards as the measure of success. The gap between claimed and actual zero trust is where breaches happen, and closing it requires genuine engineering discipline, not procurement.
Conclusion
Zero trust represents a fundamental shift in cybersecurity thinking — from trusting networks to verifying every transaction. The U.S. government’s mandate turned a philosophy into a policy with teeth, and the private sector followed. The transition is incomplete and uneven, but the direction is clear: the perimeter is dead, identity is the new boundary, and the assumption of breach is the new baseline. Organisations that have not begun the journey are not just behind — they are increasingly outliers in a world where standing still means falling behind.
A closing observation: Zero trust is sometimes criticised as a buzzword, and the criticism has merit when the label is applied to perimeter-based architectures with minor adjustments. But the underlying principle — verify every transaction, never assume trust — is sound, and the technology to implement it at scale exists and is improving. The challenge is operational discipline, not concept. Organisations that treat zero trust as a journey with clear milestones, not a product purchase, achieve the most meaningful results.
