Zero Trust
A security model that never trusts any request by default, even from inside the network. Every request must be authenticated, authorized, and encrypted regardless of origin.
What is Zero Trust?
In short
Zero Trust is a security model that treats every request as untrusted until it proves otherwise, no matter whether it comes from outside the network or from a server sitting in the same data center. Every connection must be authenticated, authorized against the least privilege needed, and encrypted, because location inside the network grants no implicit trust.
What Zero Trust actually means
The old model was a hard shell with a soft center. You built a firewall around the corporate network, and once a request got inside, it was treated as friendly. Anyone on the office VPN could reach internal databases, admin panels, and other servers with little extra checking. That perimeter approach falls apart the moment an attacker gets a foothold, because one stolen laptop or one compromised server gives them free movement across everything inside the wall.
Zero Trust throws out the idea that the network location tells you anything about trust. A request from a laptop in the office and a request from a random IP on the internet get the same scrutiny. The guiding phrase is never trust, always verify. Identity, device health, and context decide access, not which subnet you happen to be on.
The term was popularized by Forrester analyst John Kindervag around 2010, and the US government formalized it in NIST Special Publication 800-207. Google built one of the first large production versions, called BeyondCorp, after the 2009 Aurora attacks showed how dangerous flat internal trust can be.
How it works under the hood
Three pieces do the work. A policy engine decides yes or no for each request. A policy enforcement point sits in the request path and blocks or allows traffic based on that decision. A trust signal source feeds in identity, device posture, and context so the engine has something to reason about.
On every request the system checks who you are through strong authentication, usually multi factor or short lived tokens. It checks what device you are on and whether that device is patched, encrypted, and managed. It checks what you are asking for and grants the narrowest scope that fits, which is least privilege access. Sessions are short and re-evaluated often, so access can be pulled the instant a signal changes, like a device falling out of compliance.
Two architectural ideas make this practical. Microsegmentation splits the network into tiny zones so a workload can only talk to the specific services it needs, not the whole subnet. Identity aware proxies put an authentication and authorization gate directly in front of each application, so there is no broad internal network to roam once a single app is reached.
When to use it and the trade-offs
Zero Trust pays off most for organizations with remote workers, cloud workloads, contractors, and many internal services, which today is almost everyone. It contains breaches by stopping lateral movement, so a single compromised credential or host does not cascade into a full network takeover. It also removes the need to backhaul remote users through a slow central VPN.
The cost is real. You need a solid identity system as the foundation, accurate device inventory, and policy that is written and maintained carefully. Get the policies wrong and you either lock out legitimate users or leave gaps. Adding an authorization check to every request also adds latency and operational complexity, and the policy engine becomes a critical dependency that must be highly available.
It is not a product you buy and switch on. It is an architecture you grow into, usually one application at a time. Most teams start by putting their highest value internal apps behind an identity aware proxy, then expand coverage as they retire the old VPN.
A concrete real-world example
Google BeyondCorp is the clearest example. Google moved every internal application behind an access proxy that authenticates the user and inspects the device on each request. The result is that a Google engineer working from a coffee shop and one sitting in the Mountain View office go through exactly the same checks. There is no privileged corporate network to be on, so employees do not use a traditional VPN to reach internal tools.
Imagine an engineer opening an internal dashboard. The request hits the access proxy, which confirms the identity through single sign on, verifies the laptop is company managed and encrypted, checks that this user is allowed to see that dashboard, then forwards the request. If the same laptop later misses a security update, its trust level drops and the next request to a sensitive system is denied until it is fixed, all without changing any network setting.
Where it is used in production
Google BeyondCorp
Put every internal app behind an identity and device aware access proxy, eliminating the traditional employee VPN.
Cloudflare
Sells Zero Trust access through its Access and WARP products, replacing VPNs with an identity gate at the edge.
Microsoft
Azure AD Conditional Access enforces per request identity, device, and risk checks across Microsoft 365 and Azure workloads.
US Federal Government
Executive Order 14028 and OMB memo M-22-09 mandate Zero Trust architecture across federal agencies, anchored on NIST SP 800-207.
Frequently asked questions
- Is Zero Trust the same as a VPN?
- No, it usually replaces the VPN. A VPN drops you onto the internal network and then trusts you broadly, which is the exact model Zero Trust rejects. Zero Trust authorizes each request to each app individually, so there is no flat internal network to land on in the first place.
- Does Zero Trust mean I have to authenticate constantly?
- You re-authenticate more often than the old model, but it is not meant to be painful. Sessions use short lived tokens and single sign on, so most checks happen silently. Extra prompts like multi factor appear mainly for sensitive actions or when a risk signal changes.
- What is the difference between Zero Trust and microsegmentation?
- Microsegmentation is one technique inside Zero Trust, not the whole thing. It splits the network into small zones so workloads can only talk to what they need. Zero Trust also covers user identity, device health, least privilege, and continuous verification across all access, not just network segmentation.
- Can a small company adopt Zero Trust, or is it only for large enterprises?
- Small companies can and often do, because cloud based identity providers and access proxies do most of the heavy lifting. A practical start is enabling single sign on with multi factor, then putting your most sensitive internal tools behind an identity aware proxy before expanding.
- What is BeyondCorp?
- BeyondCorp is Google's internal implementation of Zero Trust, built after the 2009 Aurora attacks. It moves all access decisions to a per request check of user identity and device state, so employees need no VPN and the network location grants no trust.
Learn Zero Trust hands-on
This page explains the idea. The full lesson lets you step through the ring as servers join and leave, read the implementation, and check yourself with a quiz. It is one of 760+ lessons in the System Design Masterclass, from your first API call to distributed consensus. Eleven Foundation lessons are free, no signup. Lifetime access is ₹499 in India or $7.99 worldwide, one payment, no subscription.
Related lessons
Lessons that touch on Zero Trust as part of a larger topic.
Context-Aware Access Control
Combining multiple signals, device, location, behavior, risk score, to make dynamic access decisions in real time
intermediate · security architecture
Mutual TLS (mTLS)
Both client and server verify each other's certificates, two-way authentication for zero-trust architectures
intermediate · security architecture
See also
Related glossary terms you might want to look up next.
mTLS
Mutual TLS: both client and server present certificates to authenticate each other. Standard in service mesh architectures where every service verifies its peers.
RBAC
Role-Based Access Control: assigns permissions to roles (admin, editor, viewer), then assigns roles to users. Simpler to manage than per-user permissions.
OAuth
An authorization framework that lets users grant third-party apps limited access to their accounts without sharing passwords. Powers 'Sign in with Google.'
Throttling
Slowing down the rate of processing requests instead of rejecting them outright. The gentler cousin of rate limiting.
JWT
JSON Web Token: a compact, self-contained token for transmitting claims between parties. The server can verify it without a database lookup.
SSL/TLS
Cryptographic protocols that encrypt data in transit between client and server. TLS is the modern successor to SSL. The 'S' in HTTPS.