What is Zero Trust?

Zero Trust is a security model that removes implicit trust from users, devices, and network locations, treating every access request as untrusted until proven otherwise. Rather than granting broad access once inside a network perimeter, Zero Trust continuously verifies identity and device posture before granting least-privilege access to one specific resource at a time.

Key takeaways

• Zero Trust removes implicit trust from network location entirely.
• Every access request is verified continuously, not once at login.
• Access is scoped to one application at a time, least-privilege by default.
• ZTNA replaces flat VPN access with per-application enforcement.
• NIST SP 800-207 formalized the architecture’s principles in 2020.

On this page: Why it matters · How it works · Types · Zero Trust & Versa · FAQ

Why is Zero Trust important?

Traditional network security assumed that anything inside the perimeter – the corporate LAN, the VPN tunnel – could be trusted, and that the firewall’s job was to keep attackers out at the edge. That assumption broke down as applications moved to the cloud and employees started working from anywhere. Once an attacker compromises one credential on a flat network, nothing stops lateral movement to every other resource that network can reach.

Zero Trust matters because most breaches today start with a compromised credential, not a perimeter intrusion. By evaluating every connection on identity, posture, and context – rather than which network segment it originates from – Zero Trust shrinks a compromise’s blast radius to the one application a session was authorized for, and removes the need to grant broad network access just to reach one internal application.

What is Zero Trust?

Zero Trust rests on three tenets: verify explicitly, use least-privilege access, and assume breach. Every request is authenticated using all available signals – identity, device health, location, and behavioral context – instead of being trusted because it originated inside a firewall. Access is granted per session, scoped to the smallest resource that satisfies the request, not the network segment that resource sits on.

Architecturally, this is usually a Policy Decision Point (PDP) that evaluates context and issues a decision, and a Policy Enforcement Point (PEP) that carries it out at the connection boundary. NIST SP 800-207 formalized this pattern, treating verification as continuous rather than a one-time gate: a device that goes non-compliant mid-session can have its access revoked immediately, not at the next login.

Types of Zero Trust

Zero Trust is applied at several layers, usually adopted in sequence. Zero Trust Network Access (ZTNA) is the most common entry point: it replaces VPN with per-application, identity- and posture-verified access for remote users. Network-layer Zero Trust (microsegmentation) extends the same principle inside the data center or campus, dividing the network into small enforced zones so a compromised device cannot reach unrelated systems. Data-centric Zero Trust applies the model to data itself, using CASB and DLP controls to restrict what a verified session may actually move.

Zero Trust & Versa

Versa implements Zero Trust as Zero Trust Everywhere, four components under one managed policy: Versa Secure Private Access (VSPA) delivers ZTNA for remote users; Versa Zero Trust – Premises extends it to campus and branch users at the point of connection; Versa Secure SD-LAN provides the campus network with built-in microsegmentation; and the Versa SASE Fabric supplies the cloud security services that tie it together. The Security tab covers how these combine with SWG, CASB, and DLP under one policy engine.

Inside VSPA, Zero Trust runs as two policy layers in Versa Concerto: Secure Access Rules are the Policy Decision Point, evaluating identity, posture, geography, and context before a tunnel is established; Private Protection Rules are the Policy Enforcement Point, governing which applications a session may reach. Posture is assessed continuously through an Endpoint Information Profile, and Versa’s default-deny guidance – no broad RFC 1918 routes, no wildcard rules – keeps the network layer as least-privilege as the identity layer.

Frequently asked questions

What is the difference between Zero Trust and a VPN?

A VPN grants broad network-level access once a user authenticates, so a compromised session can often reach anything on that network. Zero Trust grants access per application, continuously re-verifies identity and posture, and denies what isn’t explicitly authorized.

What is Zero Trust Network Access (ZTNA)?

ZTNA is the most widely adopted form of Zero Trust: it connects a verified user directly to one authorized application without placing the device on the broader network, and re-evaluates access continuously rather than once at login.

Who created the Zero Trust model?

Analyst John Kindervag popularized the term at Forrester in 2010, arguing that trust itself was the vulnerability perimeter security couldn’t fix. NIST SP 800-207 formalized the architecture’s principles in 2020.

Does Zero Trust mean an organization doesn’t trust its own employees?

No. Zero Trust removes implicit trust granted by network location, not trust in people. Verified employees on compliant devices still get access – verification just happens every time, for every resource, instead of once at the perimeter.

How does Zero Trust relate to SASE?

SASE operationalizes Zero Trust at scale: its ZTNA service applies identity- and posture-based access decisions, and its cloud-delivered enforcement points apply them everywhere a user connects, not only at a single perimeter.

More on Zero Trust

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about Zero Trust, these are worth looking at next.