On this page
Definition
Zero trust is a security architecture built on the principle of 'never trust, always verify', requiring continuous authentication and authorisation for every user and device requesting access to resources, regardless of whether they are inside or outside the traditional network perimeter.
Simple explanation
Older security models worked like a castle with a moat: once you were inside the network (say, connected to the office Wi-Fi), you were broadly trusted to move around freely. Zero trust removes that assumption entirely.
Instead, every single request to access an application, file or system is checked on its own merits — who is asking, from what device, in what context — regardless of whether the request comes from inside the building or from the other side of the world.
Why it matters
Remote work, cloud services and personal devices have dissolved the idea of a single trusted network perimeter. An employee's laptop on home Wi-Fi and a server in a data centre now sit on equal footing from a security standpoint.
Zero trust also limits the damage from a single compromised account or device, since gaining one foothold no longer grants broad access across an organisation's systems.
How it works
- 1Identity verificationEvery user must authenticate, typically with MFA, before any access request.
- 2Device checkThe requesting device's security posture is evaluated before access is granted.
- 3Least privilegeAccess is limited strictly to what's needed for the specific task, nothing more.
- 4Continuous verificationTrust is re-evaluated throughout the session, not just at login.
- 5Micro-segmentationSystems are divided into smaller zones so a breach in one area doesn't grant access to others.
Real examples
Products named for illustration only. Inclusion is not an endorsement.
- Google BeyondCorpGoogle's internal zero trust model that removed reliance on a corporate VPN perimeter.
- Cloudflare Zero TrustA commercial platform offering identity-based access control for organisations.
- Microsoft Entra Conditional AccessEnforces continuous, context-based access policies across Microsoft 365 environments.
- ZscalerProvides zero trust network access as an alternative to traditional corporate VPNs.
Advantages
- Limits the blast radius of a single compromised account or device.
- Removes over-reliance on network location as a proxy for trust.
- Well suited to remote and hybrid work with employees on varied networks.
- Provides more granular, auditable access control across systems.
Limitations
- Implementation is complex and typically requires significant organisational change.
- Can introduce friction if authentication and verification steps aren't well designed.
- Requires ongoing investment in identity and device management tooling.
- Legacy systems not built with modern authentication in mind can be difficult to fit into a zero trust model.
Common misunderstandings
- ClaimZero trust means employees are not trusted at all.RealityIt means trust is never assumed by default and must be continuously verified, not that individuals are treated as adversaries.
- ClaimZero trust is a single product you can buy.RealityIt's an architectural approach implemented through a combination of identity, device and access management tools, not one off-the-shelf product.
Frequently asked questions
Is zero trust only relevant to large enterprises?
The full architecture is most common in larger organisations, but the underlying principles — MFA, least privilege access — benefit businesses of any size.
Does zero trust replace VPNs?
Increasingly, organisations use zero trust network access as a more granular alternative to traditional full-network VPN access.
How long does it take to implement zero trust?
It varies widely, from months for a focused rollout to years for a full organisation-wide transformation.
Does zero trust apply to personal use, not just businesses?
The core habits — verifying every login, using MFA, limiting access — are useful personal security practices even outside a formal enterprise framework.
What's the difference between zero trust and multi-factor authentication?
MFA is one component used within a zero trust model; zero trust itself is the broader architecture governing how access is granted and continuously verified.
The Tool Money Lab perspective
We see zero trust less as a specific product category to review and more as a lens for judging enterprise security tools: does this product help verify identity and limit access continuously, or does it still lean on outdated perimeter assumptions?
For smaller organisations without the resources for a full zero trust rollout, we point to the practical building blocks — MFA everywhere, least-privilege access, and strong identity management — as the accessible starting point.
Conclusion
Zero trust replaces the assumption that anything inside a network perimeter is safe with continuous verification of every user, device and request, regardless of location.
It's a significant undertaking for larger organisations, but its core principles — verify continuously, grant minimal access — are worth adopting at any scale.