Skip to content
IT Atlas

Security · Zero Trust

Zero Trust

A security model that removes implicit trust based on network location and instead verifies every request explicitly against identity, device and context.

IntermediateUpdated 2026-09-01

Overview

Zero Trust is an architecture and a set of principles, not a product. No vendor can sell you Zero Trust; they can sell components that participate in it. The model assumes the network is already hostile and that a breach has already occurred somewhere.

NIST SP 800-207 frames it as moving policy enforcement close to resources: a policy decision point evaluates each access request using identity, device posture, workload sensitivity and behavioural signals, and a policy enforcement point applies the outcome per session.

How it works

  1. 01Verify explicitly: authenticate and authorise using all available signals, including device compliance and session risk, rather than trusting a network segment.
  2. 02Use least privilege access: just in time and just enough privilege, with adaptive policy and data protection travelling with the data.
  3. 03Assume breach: segment aggressively, encrypt in transit, verify end to end, and instrument everything so detection and response are viable.
  4. 04Access is brokered per application. A user proves identity and device posture and receives access to one resource, not a route into a network.

Why it matters

  • Perimeters no longer contain the estate, SaaS, remote work and cloud workloads sit outside it by design.
  • Flat internal networks turn one compromised laptop into estate wide exposure.
  • Regulators, insurers and customers increasingly expect these controls as baseline diligence.

Layer model

Identity
Phishing resistant MFAConditional AccessJust in time privilegeIdentity risk signals
Devices
Enrolment and inventoryCompliance policyDisk encryptionEDR health as a signal
Applications
SSO for every appApp level authorisationShadow IT discoverySession controls
Data
Classification and labellingEncryptionDLPRights management
Network
Micro-segmentationEncrypted transportBroker based access instead of flat VPNEgress control
Infrastructure
Baseline hardeningConfiguration drift detectionLeast privilege workload identityTelemetry everywhere

Design considerations

  • Sequence the programme: identity and device foundations first, then application access, then segmentation and data controls.
  • Instrument before enforcing. Report only telemetry prevents avoidable outages and builds the case for change.
  • Plan for legacy systems that cannot participate, isolate them behind brokers with compensating monitoring.
  • Define measurable outcomes: percentage of applications behind SSO, percentage of access requiring compliant devices, standing privilege count.

Security considerations

  • Beware 'Zero Trust' badging on a VPN replacement alone; network access is one pillar of six.
  • Do not create new implicit trust, for example trusting any device merely because it is enrolled, without compliance evaluation.
  • Ensure the policy engine itself is protected, monitored and change controlled.

Common misconfigurations

  • Trusted network exclusions that reintroduce location based trust.
  • Device compliance policies configured but not required by access policy.
  • Micro segmentation projects that stall at design because there is no accurate application dependency map.

IT vs OT

Zero Trust principles apply to OT, but enforcement differs sharply: process availability and safety constrain what may be blocked, and many industrial devices cannot authenticate at all, so brokers and conduits carry the control. See OT Atlas.

IT Atlas covers Information Technology. Operational Technology is covered separately at otatlas.ai.

Primary sources