The Castle That Stopped Working
Corporate security used to be a castle and moat: a hard network perimeter (firewalls, VPNs) with a soft, trusting interior. Get inside (physically in the office or dialed in through VPN), and systems mostly assumed you belonged. It worked when work happened in one building on company machines.
Then work scattered to homes, phones, and cloud services, and attackers demonstrated the model's flaw over and over: breach the perimeter once, and the trusting interior is a buffet. One phished employee, one stolen VPN credential, one infected laptop inside the walls, and lateral movement did the rest. The biggest breach headlines of the past decade mostly follow that script.
The Zero Trust Answer
Zero trust throws away the concept of a trusted interior. The principle, coined at Forrester and formalised in NIST guidance: never trust, always verify. Location grants nothing. Every request to every resource gets checked, every time, based on:
- Identity: Is this really the claimed user? Strong authentication, ideally phishing resistant (passkeys, hardware keys: see our FIDO2 explainer).
- Device health: Is the laptop patched, encrypted, running protection? A valid user on a compromised device is still a threat.
- Context: Does this request make sense? Time, location, and behaviour feed the decision. Finance-database access at 3 AM from a new country gets friction or denial.
- Least privilege: Access to exactly what the role needs, nothing more, granted for as short a time as feasible.
- Assume breach: Design as though an attacker is already inside: segment everything, log everything, and make lateral movement loud and hard.
The mental shift in one line: the old model asked "are you inside the network?", zero trust asks "who are you, on what device, asking for what, and why now?" for every single door.
A Concrete Breach, Told Twice
The clearest way to feel the difference between the two models is to walk one incident through both of them.
Under the perimeter model: an employee clicks a convincing phishing link and types their VPN username and password into a fake login page. The attacker now has valid credentials and connects through the real VPN. From that point on, the attacker is "inside," and inside means trusted. They browse the internal network with a file explorer, find a shared drive with no extra authentication, discover a spreadsheet of admin passwords someone saved "temporarily" two years ago, and use those to reach the database server. Nothing they did after the first login triggered a single additional check, because the network position itself was the credential. This is, almost beat for beat, how a long list of real-world retail, healthcare, and government breaches actually unfolded: one stolen credential, then unrestricted lateral movement, because nothing on the inside was designed to say no.
Under a zero trust model, the same phished credential buys the attacker far less: the VPN login itself requires a second factor the attacker doesn't have (see our 2FA guide), so password theft alone doesn't get them in. If the attacker somehow clears that bar too (a real SIM-swapped SMS code, for instance), the next request, opening the shared drive, gets checked against device posture: the request is coming from an unmanaged personal laptop that has never been enrolled, so it's denied or heavily restricted regardless of who the credentials claim to belong to. Even if that also succeeds, micro-segmentation means the shared drive and the database server sit in different trust zones with no implicit path between them: reaching the database requires its own explicit, logged, freshly-verified request. Every single layer the attacker would need to clear costs them a separate, monitored decision point instead of one master key that opens every door behind it.
That is the entire value proposition in one story: perimeter security has one strong door and a soft interior; zero trust has no interior at all, only a long hallway of doors, each checking who's knocking.
What It Looks Like in Practice
- MFA everywhere as the identity foundation. Not once at the VPN gate: at each application, with step-up prompts for sensitive actions. Basics in our 2FA guide.
- SSO with a strong identity provider so verification is centralised and consistent (how that works: our OAuth and SSO explainer).
- Device posture checks: unmanaged or out-of-date devices get restricted access or none.
- Micro-segmentation: the HR system can't talk to the build servers; a compromised webserver can't wander into the finance network.
- VPN retirement in favour of per-application access proxies: users reach the specific app they're entitled to, not a network.
- Continuous monitoring: trust decisions get revisited mid-session, not just at login.
A useful way to see the shift side by side:
| Question | Perimeter model answer | Zero trust answer |
|---|---|---|
| Who is trusted by default? | Anyone inside the network | No one, ever, by default |
| How often is trust checked? | Once, at the VPN or office door | On every request, continuously |
| What happens if a device is compromised? | It can reach whatever the network allows | It's evaluated on its own posture per request |
| How far can an attacker move after one breach? | Often the whole internal network | Only the single segment that request was granted |
| What's the access unit? | The network | The individual resource or application |
Zero Trust for Your Personal Accounts
You don't run a corporate network, but the principles map surprisingly well to personal security:
- Verify explicitly: 2FA on every account that matters, app based rather than SMS (why: our SMS 2FA article). Try the mechanics on our free TOTP generator.
- Least privilege: Audit OAuth grants and app permissions twice a year; revoke the stale ones. Don't stay logged into what you don't use (session theft loves standing access: see session hijacking).
- Assume breach: Unique password per site, so one leak stays one leak (credential stuffing is the attack this defeats; our generator is the tool). Keep backup codes for the day a device dies.
- Don't trust the network: The public WiFi rules are zero trust in miniature: HTTPS always, verify domains, trust no captive portal.
- Verify the requester: "Your bank" calling, "your friend" messaging a link, "IT support" needing your code: verify through a second channel before acting. Social engineering is a perimeter breach of the human kind.
The Honest Caveats
- It's a strategy, not a product. Vendors stamp "zero trust" on everything with a login. Real adoption is architecture and policy work, done incrementally over years.
- Friction is real. Verify-everything done clumsily trains users to hate security. Good implementations spend heavily on making the secure path the smooth path: passkeys over codes, risk-based prompts over constant ones.
- Legacy systems resist. That twenty year old internal app with no modern auth becomes the project's boss fight. Everyone has one.
Frequently Asked Questions
Does zero trust mean my company doesn't trust me?
It means the system doesn't trust credentials and network position, because attackers steal both. It protects you too: a phished password alone no longer lets someone impersonate you and act in your name.
Is zero trust the same as MFA?
MFA is one pillar, arguably the load-bearing one, but zero trust adds device checks, segmentation, least privilege, and continuous verification on top. MFA answers "who are you"; zero trust also asks "on what, for what, and does this pattern make sense". The factor taxonomy lives in our 2FA vs MFA post.
Does zero trust kill the VPN?
It replaces the VPN's role of granting network membership. Per-app access proxies achieve the same reach with a smaller blast radius: users get applications, not a network to explore. Personal privacy VPNs are a separate topic entirely.
Can a small business do zero trust?
The affordable core: SSO through Google Workspace or Microsoft 365, MFA enforced for all staff, least-privilege roles in each SaaS tool, and managed browsers/devices where feasible. That's most of the practical benefit without an enterprise budget.
Where does 2FA fit if we adopt passkeys?
Passkeys ARE strong multi-factor verification in one gesture (device possession plus biometric), and they're phishing resistant, which codes are not. In zero trust terms they upgrade the identity pillar. Our passkey explainer covers the transition.
