Zero trust
Zero trust is an architecture that authenticates and authorises every request on its own merits instead of trusting anything because of its network location.
Updated 2 Sept 2026
In more detail
Zero trust replaces the perimeter assumption — inside the network is safe — with per-request evaluation of identity, device state and context. NIST SP 800-207 describes it as a set of principles applied to enterprise architecture rather than a product, which is why it is implemented incrementally: strong identity first, then device posture, then segmented access to individual applications.
Why Zero trust matters
Remote work and cloud services dissolved the perimeter, and most intrusions now progress laterally using valid credentials on trusted networks. Per-request authorisation removes the free movement that made that lateral phase easy, and it is the reason VPN-style all-or-nothing access is being replaced by application-level brokering.
How it works
A policy decision point evaluates each access request against identity, device compliance, application sensitivity and signals such as location or risk score, then issues a short-lived, narrowly scoped authorisation. Enforcement sits in front of individual applications or workloads, and sessions are re-evaluated rather than trusted indefinitely.
Examples
- Requiring phishing-resistant MFA and a managed-device check for each application session instead of network VPN access.
- Service-to-service calls authenticated with short-lived workload identities rather than shared network allowlists.
- Granting a contractor access to one internal application, brokered per request, with no route to the rest of the network.
How it is detected or measured
Maturity is assessed by how much access still depends on network position, whether MFA is phishing-resistant, and whether authorisation decisions are made per request and per application.
Where this matters
- Website Security Checklist
A prioritised checklist covering access, patching, backups, monitoring and response — ordered by how much risk each control removes.
- How to Start a Cybersecurity Career
The sequence that keeps working: fundamentals, one specialism, demonstrable work, then applications aimed at roles that actually hire juniors.
Sources
- Zero Trust Architecture (SP 800-207) — NIST
Definition, tenets and logical components of zero trust.
- Zero Trust Maturity Model — CISA
Staged adoption across identity, device, network and data pillars.