Cybersecurity glossary
What is Zero Trust Architecture?
Learn what Zero Trust Architecture is, how it differs from perimeter security, which core principles guide identity-aware access, and how teams adopt ZTA without boiling the ocean.
Definition
Zero Trust Architecture (ZTA) is a cybersecurity approach that assumes no implicit trust based on network location—every access request must be authenticated, authorized, and continuously evaluated against policy using identity, device posture, and context.
Why Zero Trust Architecture matters
Castle-and-moat security assumed a safe inside. Remote work, cloud SaaS, contractor access, and microservices destroyed that assumption. Attackers who phish one VPN user should not inherit the whole flat network.
Zero Trust Architecture redesigns access so identity, device, and context—not IP ranges—decide what is allowed. It is a strategy for limiting blast radius in a world without a trustworthy perimeter.
Core Zero Trust principles
Authenticate explicitly
Strong identity for users and services; MFA for humans; workload identity for machines.
Authorize with least privilege
Grant the minimum access for the task, preferably just-in-time and just-enough.
Assume breach
Design for detection, containment, and limited lateral movement from day one.
Inspect and log continuously
Decisions and sessions produce telemetry that security operations can use.
How a Zero Trust access decision works
Subject requests a resource
A user, device, or service attempts to reach an application or API.
Policy engine evaluates signals
Identity assurance, device posture, location, risk score, and resource sensitivity feed the decision.
Policy enforcement point applies the result
An identity-aware proxy, mesh sidecar, or agent allows, denies, or steps up auth.
Session is time-bound and monitored
Tokens expire; continuous checks can revoke access if risk rises.
Lateral paths stay closed by default
Microsegmentation and service identity stop open network neighborhoods.
Outcomes feed improvement
Logs refine policies and reveal shadow IT or over-permissioned roles.
Perimeter model vs Zero Trust
| Topic | Traditional perimeter | Zero Trust |
|---|---|---|
| Primary trust signal | Being inside the network / VPN | Verified identity + context every time |
| Internal traffic | Often largely trusted | Authenticated and authorized |
| Access scope | Broad network segments | Application and data-scoped |
| Failure mode | One foothold → wide lateral movement | Compromise contained by policy boundaries |
Building blocks you will actually deploy
Identity provider and MFA
Central SSO with phishing-resistant factors where possible.
Device posture
Managed device checks (disk encryption, patch level, EDR health) before sensitive access.
ZTNA / identity-aware proxies
Per-app access instead of flat VPN networks.
Microsegmentation and mesh mTLS
Service-to-service identity inside clouds and clusters.
Data-aware controls
Classification, DLP, and encryption tied to the resource—not only the path.
Visibility and response
Unified logs, detections, and rapid revocation workflows.
Adoption pitfalls
Zero Trust fails when it becomes a logo on a firewall purchase. Common traps include leaving flat admin networks in place, ignoring service accounts, or enforcing MFA on users while service-to-service calls remain open by IP.
Start with a few crown-jewel applications, measure policy denials and user friction, then expand. Perfect coverage is a maturity journey—not a weekend cutover.
Practical checklist
- Inventory critical apps, data stores, and admin planes as Zero Trust priorities.
- Enforce MFA and modern SSO on those apps before chasing exotic network features.
- Replace broad VPN ACLs with per-application access where feasible.
- Give every workload an identity; encrypt east-west traffic with mTLS or equivalent.
- Remove standing privileges; prefer short-lived credentials and just-in-time admin.
- Log access decisions centrally and alert on impossible travel, device failures, and privilege spikes.
- Segment break-glass paths with extra monitoring—they are high-value targets.
- Revisit policies quarterly as applications and contractor relationships change.
The practical takeaway
Zero Trust Architecture rejects implicit trust based on network location. Every access request is verified using identity, device, and context, with least privilege and continuous evaluation as defaults.
Treat Zero Trust as an operating model: strong identity first, application-scoped access second, encrypted service identity third, and relentless visibility throughout. The goal is not zero incidents—it is dramatically smaller blast radius when incidents happen.
Related security terms
Service Mesh
A common way to enforce identity-based mTLS between microservices.
Multi-Factor Authentication (MFA)
A foundational control for strong user identity in Zero Trust designs.
Single Sign-On (SSO)
Central identity often used as the policy decision input for access.
OAuth 2.0
A common authorization framework for delegated access tokens.
Web Application Firewall (WAF)
Complements Zero Trust at the application edge but does not replace identity checks.
Frequently asked questions
What is Zero Trust in simple terms?
It means not trusting someone just because they are “on the company network.” Every request to an app or service must prove who is asking, from which device, and whether policy allows that action.
Does Zero Trust eliminate VPNs?
Not always immediately. Many organizations replace broad VPN access with identity-aware application access (ZTNA), while still using VPNs selectively during transition.
Is Zero Trust a product?
No. It is an architecture and set of principles implemented with identity, device, network, and application controls—often from multiple vendors.
What does “never trust, always verify” mean?
Past authentication or network admission is not enough. Access is re-checked with current identity, device health, and context for each session or request as policy requires.
How is this different from perimeter security?
Classic models trusted interior traffic after a hard shell. Zero Trust treats interior traffic as hostile until proven otherwise.
Where should teams start?
Identify critical applications, enforce strong identity/MFA, remove flat network access to those apps, and expand policy coverage iteratively.
Does Zero Trust stop all breaches?
No. It reduces blast radius and makes lateral movement harder, but phishing, flawed apps, and misconfiguration still require layered defenses.
References
Explore authoritative guidance and frameworks related to zero trust architecture.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.