.svg){kind=small}
Zero Trust is a cyber security approach that does not automatically trust a user, device or application simply because it is already inside an organisation's network. Instead, access is granted only after the request has been checked and authorised using relevant information such as identity, device condition, location, risk and the resource being requested.
The idea is often summarised as never trust automatically, always verify. In practice, Zero Trust is not a single product. It is a way of designing identity, access, device, network, application and data security so that unnecessary trust is removed.
Why was Zero Trust developed?
Traditional security models often concentrated heavily on the network perimeter. The assumption was that users and devices outside the corporate network were untrusted, while activity inside the network was more trustworthy.
That model is much harder to rely on today. Organisations use cloud services, remote working, mobile devices, software-as-a-service applications, contractors, partners and systems distributed across multiple locations.
NIST's Zero Trust Architecture guidance explains that Zero Trust moves the focus away from static network boundaries and towards protecting users, assets and resources. A user or device is not automatically trusted simply because of its location or ownership.
What are the main principles of Zero Trust?
Microsoft describes three widely used Zero Trust principles:
- Verify explicitly - authenticate and authorise access using the information available.
- Use least privilege access - give users and workloads only the access they need, and only for as long as they need it.
- Assume breach - design controls on the basis that an attacker may already have gained access somewhere in the environment.
These principles are useful because they turn Zero Trust from a slogan into practical security decisions.
What does 'verify explicitly' mean?
Verification should consider more than a username and password.
An access decision may include:
- the identity of the user
- whether multi-factor authentication has been completed
- the device being used
- whether the device is managed and compliant
- the user's location
- sign-in risk
- the sensitivity of the requested application or data
- whether the behaviour is normal for that user
For example, an employee signing in from their managed laptop during normal working hours might be treated differently from the same account suddenly attempting to access sensitive information from an unknown device in another country.
What is least privilege?
Least privilege means giving a person, application or service the minimum access required to complete its task.
If an employee only needs to read a set of files, they should not automatically receive permission to delete them. If an administrator only needs elevated rights occasionally, those rights do not need to remain permanently active.
Reducing privileges limits the damage that can occur if an account is compromised.
What does 'assume breach' mean?
Assume breach does not mean believing every employee is malicious. It means accepting that no security control is perfect.
Passwords can be stolen. Devices can be compromised. Vulnerabilities can be exploited. Suppliers can be attacked.
A Zero Trust design therefore asks: If one account or device is compromised, how far could an attacker get?
Controls such as segmentation, limited permissions, monitoring and strong identity protection are used to reduce that potential impact.
Is Zero Trust the same as multi-factor authentication?
No. Multi-factor authentication (MFA) is an important Zero Trust control, but Zero Trust is much broader.
MFA helps verify identity by requiring more than one form of evidence. However, a Zero Trust approach may also consider device health, permissions, application sensitivity, network context, risk signals and ongoing activity after sign-in.
Think of MFA as one important part of the Zero Trust model rather than the model itself.
Does Zero Trust mean nobody is trusted?
Not exactly.
Users can still be granted access. The difference is that trust is not assumed permanently or granted simply because someone is connected to the internal network.
Access is explicit, limited and re-evaluated when circumstances change.
Is Zero Trust only for large organisations?
No. Large organisations may implement sophisticated Zero Trust architectures, but smaller organisations can adopt the same principles.
For example, a small business can:
- enable MFA
- remove unnecessary administrator privileges
- require managed devices for sensitive systems
- disable accounts promptly when staff leave
- separate important systems
- review access regularly
- monitor suspicious sign-ins
These are practical Zero Trust behaviours even without a complex enterprise security platform.
How does Zero Trust protect identities?
Identity is central to modern Zero Trust because users can access resources from many networks and locations.
Common identity controls include:
- multi-factor authentication
- strong authentication methods
- conditional access
- single sign-on
- privileged identity management
- regular access reviews
- risk-based sign-in policies
- separate administrator accounts
Microsoft Entra ID and similar identity platforms can use multiple signals when deciding whether access should be granted.
Professionals responsible for Microsoft identity can develop these skills through courses such as Microsoft Identity and Access Administrator (SC-300).
How does Zero Trust protect devices?
A valid username does not guarantee that the device being used is safe.
A Zero Trust policy may check whether a device:
- is registered or managed
- has current security updates
- has endpoint protection enabled
- meets encryption requirements
- has been detected as compromised
- complies with organisational security policies
A user may therefore be allowed to access email from one device but blocked from downloading confidential files to an unmanaged personal computer.
How does Zero Trust apply to networks?
Zero Trust does not make network security irrelevant. Instead, it avoids treating the entire internal network as one trusted zone.
Organisations can use segmentation and microsegmentation to limit which systems can communicate with each other.
If an attacker compromises one workstation, network controls can make it harder to move laterally towards servers, backups or sensitive applications.
What is microsegmentation?
Microsegmentation divides an environment into smaller security zones and applies controls between them.
Rather than allowing broad communication simply because systems are on the same internal network, access is limited according to business need.
NIST includes microsegmentation among the technologies used in practical Zero Trust implementations.
How does Zero Trust protect applications?
Applications should require appropriate authentication and authorisation regardless of where a user is connecting from.
Access can be based on role, device, risk and the sensitivity of the application. Legacy applications that rely heavily on network location or weak authentication may need additional controls or modernisation.
How does Zero Trust protect data?
Data protection should follow the sensitivity of the information rather than assuming everything inside a network is equally safe.
Relevant controls can include:
- data classification
- encryption
- access permissions
- data-loss prevention
- rights management
- monitoring
- retention and information-governance policies
The aim is to ensure that even an authenticated user cannot automatically access every piece of information.
What is Conditional Access?
Conditional Access is a policy-based approach that evaluates conditions before allowing or restricting access.
For example, a policy might require MFA when a user signs in from outside the UK, block access from a device that does not meet security requirements, or require a stronger authentication method for an administrator.
Conditional Access is closely associated with Zero Trust because it helps replace broad trust with explicit access decisions.
Does Zero Trust replace firewalls?
No. Firewalls, network controls, endpoint protection, identity security and monitoring all still have roles.
Zero Trust changes the assumption that passing through one perimeter control should provide broad ongoing trust.
What role does security monitoring play?
Zero Trust access decisions become stronger when organisations can detect unusual behaviour.
Monitoring may identify:
- impossible or unusual travel
- unexpected administrator activity
- large data downloads
- malicious processes
- unusual network connections
- multiple failed authentication attempts
- activity from a device already associated with an incident
Security Operations Centre teams can investigate these signals. See What Does a SOC Analyst Do? for an explanation of SOC monitoring and incident investigation.
Can Zero Trust help reduce ransomware risk?
It can reduce opportunities for ransomware attackers to move through an environment, although it cannot guarantee that ransomware will never occur.
Strong authentication can make stolen passwords less useful. Least privilege reduces excessive account access. Segmentation can restrict lateral movement. Monitoring can identify unusual activity earlier.
Our guide What Is Ransomware and How Does It Work? explains the wider ransomware threat and recovery considerations.
What is Zero Trust Network Access?
Zero Trust Network Access (ZTNA) is a technology approach that provides access to specific applications or resources based on identity and policy rather than giving a user broad access to a network.
ZTNA is related to Zero Trust, but the two terms are not interchangeable. Zero Trust is the wider security strategy; ZTNA is one way of implementing part of that strategy.
Is Zero Trust the same as a VPN?
No.
A traditional VPN often connects a remote user to part of the internal network. Zero Trust access models aim to grant access only to the specific resources required and to evaluate the request using identity and other security signals.
VPN technology can still be used within a wider Zero Trust architecture, depending on the environment.
How should an organisation start implementing Zero Trust?
Do not try to replace everything at once.
A practical sequence is:
- Understand identities. Know which employees, administrators, service accounts and external users exist.
- Enable strong authentication. Prioritise MFA and modern authentication.
- Remove excessive access. Review administrator rights and old permissions.
- Understand devices. Identify which devices are managed and which should be allowed to access sensitive systems.
- Identify important data and applications. Apply stronger controls where the business impact is greatest.
- Segment access. Avoid unnecessary communication between systems.
- Improve monitoring. Collect useful identity, endpoint and network signals.
- Review continuously. Zero Trust is an operating model, not a one-off installation.
What mistakes should organisations avoid?
Buying a 'Zero Trust product' and assuming the job is finished
No single product creates Zero Trust. It requires coordinated identity, device, network, application, data and monitoring controls.
Ignoring legacy systems
Older applications may use authentication methods or network assumptions that do not fit a modern Zero Trust model.
Applying excessive restrictions without considering users
Security controls that make legitimate work unnecessarily difficult may encourage people to find workarounds. Policies should protect resources while remaining practical.
Forgetting service accounts and workloads
Zero Trust applies to applications and machine identities as well as human users.
What skills are useful for Zero Trust security?
Zero Trust crosses several technical areas, including:
- identity and access management
- network security
- endpoint management
- cloud security
- security operations
- data protection
- risk management
Microsoft security professionals may begin with Microsoft Security, Compliance and Identity Fundamentals (SC-900) before moving into more specialised roles such as SC-300 or SC-200.
Frequently asked questions
Is Zero Trust a product?
No. It is a security architecture and operating approach. Products can help implement Zero Trust controls, but buying one tool does not create a complete Zero Trust environment.
Does Zero Trust mean checking a user every few seconds?
Not necessarily. It means trust is explicit and can be re-evaluated when risk or context changes rather than being granted indefinitely.
Can Zero Trust work with cloud services?
Yes. Cloud and hybrid environments are major reasons organisations adopt Zero Trust approaches.
Does Zero Trust eliminate passwords?
No, although organisations may move towards stronger passwordless authentication methods. The broader principle is to use strong, appropriate authentication and not rely on a password alone.
Is Zero Trust only a Microsoft concept?
No. Zero Trust is an industry-wide security model. NIST publishes vendor-neutral Zero Trust architecture guidance, while Microsoft, Cisco, Google and many other technology providers implement the principles in their platforms.
Continue learning about cyber security
Browse ExperTrain's Cyber Security training or use the Cyber Security Glossary for explanations of common terms including MFA, ransomware, phishing, SIEM and least privilege.
If you are considering a career in security, read How Do You Start a Career in Cyber Security? and Which Cyber Security Certification Should I Take?.
Further reading
Found this article useful? Add ExperTrain as a Preferred Source on Google to help surface more of our training guides, articles and learning resources.
.png){kind=small}
