The old model trusted anything inside the network perimeter. Zero Trust throws that out: never trust, always verify - every request is authenticated, authorized and continuously evaluated, regardless of where it comes from.
Core principles
- Verify explicitly - authenticate and authorize every request using all available signals (identity, device health, location, risk).
- Least-privilege access - just-enough, just-in-time permissions; no standing admin.
- Assume breach - segment to limit blast radius, encrypt end to end, and inspect/log everything.
The building blocks
- Strong identity + phishing-resistant MFA as the new perimeter.
- Device posture - only healthy, compliant devices get access.
- Micro-segmentation - workloads and apps isolated so one compromise doesn't spread.
- Continuous evaluation - access can be revoked mid-session on a risk change.
- Rich telemetry - because you inspect and log all of it.
Why it matters for defenders
Zero Trust doesn't remove the need for detection - it makes detection more effective by shrinking trust and generating better signals (per-request auth, device state, segmentation crossings). It's a journey, not a product: start with identity + MFA, add device posture and segmentation, and reduce standing privilege over time.