Zero trust is a security model built on the principle "never trust, always verify", every access request is authenticated, authorized, and continuously evaluated based on identity, device, and context, regardless of where it originates, rather than being trusted because it comes from inside a network perimeter. It replaces the old "castle-and-moat" model, where anything inside the network was trusted, with continuous, identity-centric verification.

The old perimeter model broke down as work went remote, applications moved to the cloud, and breaches routinely originated inside the "trusted" network. Zero trust assumes the perimeter is gone, and that any request, internal or external, could be hostile.

The core principles

• Verify explicitly: authenticate and authorize every request using all available signals, identity, device health, location, behavior, risk.
• Assume breach: design as if attackers are already inside, limiting blast radius through segmentation and least privilege.
• Least privilege: grant the minimum access needed, for the shortest time needed.
• Continuous evaluation: trust isn’t granted once; it’s continuously reassessed as context changes.

Why identity is the foundation of zero trust

When you can’t trust the network, identity becomes the control plane. Every zero-trust decision hinges on reliably knowing who (or what) is making a request and whether they should be allowed: which makes strong authentication, fine-grained authorization, and continuous risk evaluation the pillars of the model. This is why "identity is the new perimeter" is the shorthand for zero trust: the security boundary is no longer the network edge but the point at which each identity’s access is verified. Weak identity undermines the whole architecture.

Zero trust in practice

Implementing zero trust means phishing-resistant authentication (so identity claims are trustworthy), least-privilege authorization enforced per request (so a compromised identity can reach little), device and risk signals feeding access decisions (so context matters), micro-segmentation (so lateral movement is contained), and continuous monitoring (so trust is revisited when signals change). It’s a journey, not a switch, organizations adopt zero-trust principles incrementally across their environment.

Zero trust and customer identity

Zero trust is often discussed for workforce and infrastructure security, but its principles apply directly to customer identity too. Treating every customer request as something to verify by identity, device, and risk (rather than trusting a session indefinitely after login) is exactly what risk-based authentication and continuous evaluation deliver. Account takeover, session hijacking, and fraud all exploit implicit trust granted after an initial login; a zero-trust posture that keeps evaluating risk throughout the session closes those gaps. In this sense, modern CIAM with risk-based orchestration is zero trust applied to the customer.

Why it matters

Zero trust has moved from buzzword to baseline expectation, reinforced by government mandates and the reality that perimeter defenses fail. Its value is resilience: by verifying continuously and limiting privilege, it contains breaches that would otherwise spread, and it secures the distributed, cloud-based, API-driven, increasingly AI-agent-populated environments that the perimeter model was never designed for. And because it rests on identity, investing in strong identity and access management is investing in zero trust.

Common misconceptions about zero trust

Zero trust is widely misunderstood, partly because it’s been heavily marketed. It is not a single product you buy, no vendor can sell you "zero trust" in a box; it’s an architecture and a set of principles implemented across many capabilities. It doesn’t mean "trust no one ever" in a way that blocks legitimate work; it means "verify explicitly rather than trust implicitly," so authorized users still get smooth access, just continuously verified. It isn’t only a network concern, identity, devices, applications, and data are all in scope, with identity as the linchpin. And it isn’t a project you finish; it’s an ongoing posture that organizations mature into incrementally. Seeing zero trust clearly (as an identity-centric, continuously-verifying architecture rather than a purchasable gadget) is what separates real implementations from box-checking.

Frequently asked questions

Is zero trust a product you can buy?

No, it’s an architecture and set of principles implemented across identity, device, and access capabilities, not a single purchasable product.

Does zero trust make access harder for legitimate users?

Not when done well. It verifies continuously rather than adding friction, so authorized users get smooth access while risk is constantly evaluated.

Is zero trust required by regulation?

Government mandates (such as US federal directives) increasingly require zero-trust architectures, and it’s become a baseline expectation in security frameworks broadly.

What is zero trust?

A security model that verifies every access request by identity, device, and context ("never trust, always verify") instead of trusting a network location.

What are the principles of zero trust?

Verify explicitly, assume breach, enforce least privilege, and continuously evaluate trust as context changes.

Why is identity central to zero trust?

When the network can’t be trusted, identity becomes the control plane, every decision depends on verifying who is making the request.

Does zero trust apply to customer identity?

Yes: continuously verifying customer requests by identity, device, and risk (rather than trusting a session after login) is zero trust applied to CIAM.

Related: Authorization · Principle of Least Privilege · Risk-Based Authentication · Continuous Authentication · Passkeys · IAM