Zero Trust
Zero Trust is a security model that does not trust any user, device or network by default – not even inside the corporate network. Every access is authenticated, authorized and continuously verified.
The classic security model trusted everything inside the corporate network and distrusted everything outside – like a castle with a moat. With remote work, cloud and attacks that increasingly come from inside, that model is outdated. Zero Trust turns the principle around: trust no one, verify everything. Every access is checked individually, whether from the office, home or the cloud.
What is Zero Trust?
Zero Trust (Zero Trust Architecture, ZTA) is a security concept based on 'Never trust, always verify'. Unlike the traditional perimeter model, no user or device is automatically trusted – regardless of location or network. Every access request is evaluated by identity, device state, location, time and behaviour (context-based authorization). Least privilege ensures users and systems get only the minimum necessary permissions. Micro-segmentation divides the network into small zones so a compromised segment does not automatically grant access to others. Zero Trust was shaped by Forrester Research and is a central framework in cybersecurity, recommended by NIST (SP 800-207) among others.
How does Zero Trust work?
On an access attempt the Zero Trust system checks several factors: Is the user authenticated (e.g. with MFA)? Is the device known, up to date and compliant with security policy? Is the request contextually reasonable (location, time, behaviour)? Does the user have the minimum permissions for the requested resource? Only when all checks pass is access granted – and only to that specific resource, not the whole network. Continuous monitoring and anomaly detection can revoke access if context changes.
Practical Examples
An employee working from home accesses the CRM: The system checks identity (MFA), device state (current OS, antivirus active) and location before granting access.
A microservice calling another in Kubernetes is secured with mTLS and service mesh policies – every call is authenticated.
Cloud access is controlled by an Identity-Aware Proxy (e.g. Google BeyondCorp) that makes context-based decisions instead of VPN.
A company implements micro-segmentation so a compromised office printer cannot access the finance database.
A SIEM detects unusual behaviour (e.g. login from another country) and revokes the user's access until verified.
Typical Use Cases
Remote and hybrid work: Secure access without classic VPN, based on identity and device instead of network location
Cloud migration: Zero Trust secures access to cloud resources whether users are in the office or on the move
Micro-segmentation in data centres and Kubernetes limits lateral movement in case of a security incident
Insider threat protection: Internal users and systems also get only minimal, context-checked permissions
Compliance: Zero Trust supports GDPR, ISO 27001 and BSI requirements through granular access control
Advantages and Disadvantages
Advantages
- Higher security: Every access is checked individually instead of blanket trust
- Protection against lateral movement: Even after a breach, segmentation limits damage
- Cloud-ready: Zero Trust works across network boundaries and fits hybrid and multi-cloud
- Better visibility: Continuous monitoring gives detailed insight into all access
- Compliance: Granular access logs simplify audits and proof of compliance
Disadvantages
- Implementation effort: Zero Trust is an architectural change, not a single product
- Complexity: Integrating identity, device management, segmentation and monitoring needs expertise
- Culture change: Staff must get used to stricter access controls and more frequent authentication
- Cost: Initial investment in technology, consulting and training can be substantial
Frequently Asked Questions about Zero Trust
Do I still need a VPN with Zero Trust?
How do I start introducing Zero Trust?
Is Zero Trust only for large enterprises?
Related Terms
Want to use Zero Trust in your project?
We are happy to advise you on Zero Trust and find the optimal solution for your requirements. Benefit from our experience across over 200 projects.