Why the perimeter failed
Remote work, SaaS tools and cloud infrastructure mean there is no longer a clear inside. A single compromised laptop or leaked credential inside a flat network can reach far more than it should.
Core principles
Zero trust, as described in NIST SP 800-207, rests on a few ideas:
- Never trust, always verify: authenticate and authorise every request, regardless of network location.
- Least privilege: grant the minimum access needed, for the minimum time.
- Assume breach: segment systems so a compromise in one area cannot spread freely.
- Continuous evaluation: device health, user behaviour and context inform access decisions in real time.
Practical first steps
Most organisations start with identity: strong, phishing-resistant multi-factor authentication and single sign-on across applications. From there, replace broad VPN access with per-application access, segment production environments, and centralise logging so unusual behaviour is visible.
A journey, not a product
No single tool delivers zero trust. It is an architecture and an operating model, adopted incrementally — highest-risk systems first — and measured by how much a single compromised account can actually reach.
