Zero Trust Security
A security model that requires verification for every access request, regardless of whether it originates inside or outside the network.
Definition
Zero trust security eliminates implicit trust based on network location. Every access request—whether from an employee's laptop inside headquarters or a contractor's phone in another country—must be authenticated, authorized, and continuously validated.
This model replaces the traditional "castle and moat" approach where anyone inside the network was trusted. Zero trust assumes breach and implements principles of least privilege and continuous verification.
Why It Matters
Remote work and cloud services make perimeter-based security obsolete. Organizations with distributed workforces need security models that work regardless of where employees connect from.
Zero trust significantly reduces breach impact by limiting lateral movement when accounts are compromised.
Examples in Practice
A company implements zero trust by requiring MFA for every application access, even for employees on the office network.
An agency's freelancers get scoped access to only the specific client files they need, with access automatically revoked when projects end.
A zero trust architecture limits damage when an employee's credentials are phished—the attacker can't pivot to other systems without additional verification.