Zero Trust is a security model in which no user, device or traffic flow is considered trustworthy by default, even when it sits inside the company network: every access to a resource must be verified.
It is the opposite of the perimeter model, in which a firewall and a VPN protect an internal network where everyone trusts each other. With remote work and the cloud, that perimeter no longer really exists. Zero Trust rests on three principles:
- explicitly verifying identity, with strong authentication (MFA);
- taking context into account: up-to-date device, location, unusual behavior;
- granting only what is strictly necessary (least privilege).
The model was formalized notably by NIST and popularized by Google's BeyondCorp project. It is implemented in stages, often with network access solutions known as ZTNA (Zscaler, Cloudflare, Tailscale) that gradually replace VPNs.
Why it matters when hiring
Zero Trust is not a product you install but a multi-year effort that touches identity, the network, workstations and applications. It is steered by a CISO or a security architect and implemented with Cloud Security Engineers or network engineers. Ask the candidate where they started and what they had to give up along the way: a real practitioner has trade-offs to talk about.