Somewhere along the way, Zero Trust turned into a checkbox on a purchase order. Vendors will happily sell you a Zero Trust product, but there is no such thing. Zero Trust is an architecture and a strategy, a set of principles you apply across identity, devices, networks, and data. You can buy tools that help you implement it, but you cannot buy the outcome off a shelf. This post covers the three principles that define it, why identity is now the perimeter, how microsegmentation and continuous verification work in practice, and where ZTNA fits versus a traditional VPN.
The three principles that actually define it
Strip away the marketing and Zero Trust rests on three ideas. Every real implementation traces back to these:
- Never trust, always verify. Location on the network is not proof of anything. A request from inside the office is treated with the same suspicion as one from a coffee shop.
- Assume breach. Design as if an attacker is already inside. That mindset pushes you toward containment, logging, and limiting how far any single compromise can spread.
- Least privilege. Every user, device, and service gets the minimum access needed to do its job, and nothing more, for no longer than necessary.
Notice that none of these is a product. They are design decisions that shape how you configure the tools you already own and the ones you add.
Identity is the new perimeter
For decades security meant a hard outer wall: get past the firewall and you were trusted. Cloud, remote work, and mobile devices dissolved that wall. There is no single edge to defend anymore, so the question shifts from where is the request coming from to who and what is making it.
That makes identity the control plane. Strong IAM and phishing-resistant MFA stop being nice-to-haves and become the foundation everything else stands on. If an attacker can trivially become a valid user, no amount of network segmentation saves you. This is why most serious Zero Trust journeys start with identity: cleaning up accounts, enforcing MFA everywhere, and tying access decisions to verified identity rather than IP address.
You cannot buy Zero Trust. You can only buy tools that help you practice it.
Microsegmentation: shrinking the blast radius
Assume breach has a direct architectural consequence: stop building flat networks. In a flat network, one compromised laptop can reach the domain controller, the finance database, and the backup server because everything can talk to everything. Microsegmentation carves the environment into small zones with explicit rules about what may communicate with what.
The goal is not to make an attacker's first foothold impossible; the goal is to make the second step hard. If a compromised workstation can only reach the three services it legitimately needs, the intruder is boxed in instead of free to roam. Microsegmentation is least privilege applied to network paths rather than user accounts, and in the cloud it often starts with getting your baseline configuration right. Our Cloud Security Baseline Generator is a practical place to begin tightening those defaults.
Continuous verification: trust is a moment, not a state
Traditional access is a one-time gate: authenticate once in the morning and you are trusted until you log off. Zero Trust treats trust as perishable. Continuous verification re-evaluates each request against current signals: is the device still healthy and patched, is the user behaving normally, is this resource unusually sensitive, has anything about the session changed?
In practice this means access decisions are adaptive. A routine request from a known device might pass silently, while the same user reaching for a sensitive system from a new device triggers a step-up challenge or a denial. The session is never permanently trusted; it is continuously re-earned. That is what verify actually means when you take it seriously.
ZTNA versus the VPN
This is where the strategy meets a concrete technology choice. A traditional VPN drops a remote user onto the corporate network. Once connected, they are inside, and inside historically meant trusted, which is the exact assumption Zero Trust rejects. A VPN authenticates you to a network; it rarely limits where you can go once you are on it.
ZTNA (Zero Trust Network Access) flips the model. Instead of granting network access, it brokers access to specific applications, one at a time, based on verified identity and device posture, and it re-checks continuously. The user connects to the app, not the network, and never gets broad lateral reach. The applications themselves stay invisible to anyone who is not explicitly authorized, which shrinks the attack surface dramatically.
- VPN: authenticate once, land on the network, reach much of it. Trust is coarse and mostly permanent.
- ZTNA: authenticate per application, prove device health, get exactly that app. Trust is fine-grained and continuously re-checked.
- ZTNA is one tool that expresses Zero Trust principles; it is not the whole strategy by itself.
Where to start
Because Zero Trust is a strategy, you implement it in stages rather than flipping a switch. A sensible order is identity first (MFA everywhere, clean up privileged accounts), then device posture, then segmentation of your most sensitive systems, then replacing broad VPN access with application-level ZTNA. Each step reduces risk on its own, and you never have to boil the ocean.
If you want a structured way to plan and measure the journey, map your efforts to a recognized model. Our walkthrough of the NIST CSF in plain English gives you a vocabulary for identify, protect, detect, respond, and recover that fits neatly around Zero Trust principles. Buy tools if you need them, but remember what you are actually building: a way of working that assumes breach and verifies everything, every time.