Glossary
Zero trust
Zero trust is an architecture that authenticates and authorises every request on its own merits instead of trusting anything because of its network location.
Updated 2 Sept 2026
In detail
Zero trust replaces the perimeter assumption — inside the network is safe — with per-request evaluation of identity, device state and context. NIST SP 800-207 describes it as a set of principles applied to enterprise architecture rather than a product, which is why it is implemented incrementally: strong identity first, then device posture, then segmented access to individual applications.
Why it matters
Remote work and cloud services dissolved the perimeter, and most intrusions now progress laterally using valid credentials on trusted networks. Per-request authorisation removes the free movement that made that lateral phase easy, and it is the reason VPN-style all-or-nothing access is being replaced by application-level brokering.
Examples
- Requiring phishing-resistant MFA and a managed-device check for each application session instead of network VPN access.
- Service-to-service calls authenticated with short-lived workload identities rather than shared network allowlists.
- Granting a contractor access to one internal application, brokered per request, with no route to the rest of the network.