What is zero trust?

Zero trust is a modern cybersecurity model designed for the era of cloud services, SaaS applications, mobile devices and hybrid workforces. Unlike conventional perimeter-based security approaches, the zero trust security model assumes every user, device and application is inherently untrusted and must be authenticated and continuously authorized based on real-time contextual information, whether it resides inside or outside an enterprise network.

Why zero trust matters

Traditional perimeter-based enterprise security architectures were designed to protect conventional on-premise IT infrastructure and to defend trusted corporate network borders. Today, businesses routinely deploy applications in the cloud, beyond the secure confines of the enterprise network. And users access applications and SaaS solutions from any place, using both company-supplied and personal devices, often bypassing the trusted enterprise network altogether.

Identity has emerged as a primary attack vector. Threat actors routinely target identities to steal credentials, using them to log in as legitimate users, traverse networks, exfiltrate data and carry out further attacks.

Credential abuse plays a role in 39% of breaches, according to a Verizon 2026 Data Breach Investigations Report. And according to IBM’s 2026 Cost of a Data Breach Report, it takes an average of 247 days to identify and contain these types of breaches. 

A 2025 cyberattack on British retailer Marks & Spencer shows how identity-based attacks can quickly escalate into major business disruptions. Threat actors used social engineering techniques to gain access to a legitimate account and spread ransomware across the retailer's IT estate. The attack disrupted operations for weeks, shut down online shopping and cost the company an estimated £300 million or over 30% of its annual operating profit.

Zero trust reduces the blast radius

Zero trust takes an identity-centric, location-independent approach to cybersecurity, replacing implicit trust with continuous, policy-based authorization. It enforces the principle of least privilege access, helping reduce credential theft and abuse risks, restrict lateral movement and contain attacks.

Zero trust reduces the blast radius by limiting what attackers can do after gaining illicit access. It helps mitigate ransomware, credential-based and supply chain attacks by enforcing least privilege, continuously authorizing identities and restricting lateral movement. It also reduces the attack surface by eliminating unnecessary standing privileges, helping mitigate both insider threats and external attacks.

As an increasingly important business requirement, zero trust is not just a security best practice. Many government regulations and industry frameworks require or encourage zero trust principles. And cyber insurers increasingly require policyholders to implement zero trust controls and also demonstrate proof of compliance as a condition of coverage.

Zero trust is central to agentic AI security

Zero trust was originally applied to network security and human user access, but in today’s enterprises, non-human identities (NHIs) including AI agents far outnumber their human counterparts.

Most AI agents operate outside established identity and access controls, with no authorization enforcement and no audit trail. They typically inherit the access rights of whoever deployed them, whether that's a person's own credentials or a shared service account. Often those accounts carrying far more privileges than the task requires. Because agents are built to complete a goal, they will work to complete it, finding ways to obtain elevated privileges if that's what the task demands. Worse still, AI agents operate at machine speed, making it difficult for security teams to identify and mitigate threats before they spread across the enterprise.

In a  2026 IBM Institute for Business Value report, 77% of CIOs and CTOs said AI adoption is outpacing their current governance capabilities. According to a 2026 Delinea Identity Security report, 80% of organizations cannot always explain why an NHI took a privileged action.

Zero trust principles provide the governance framework needed to secure agentic AI deployments by removing standing privileges and continuously authorizing AI agents at runtime based on policies and live contextual data.

Zero trust versus traditional perimeter security

Traditional security	Zero trust
Trust based on network location	Trust based on verified identity and context
One-time authentication	Strong authentication and continuous authorization
Broad, standing access	Least privilege and just-in-time access
Perimeter-focused security	Identity-centric security
Static access policies	Dynamic, risk-based authorization
Assumes users inside the network are trusted	Assumes no user, device or application is inherently trusted

The core principles of zero trust

Although implementations vary, most zero- trust architectures are built on three fundamental principles.
Verify explicitly

Every request for access is evaluated individually based on policy and contextual data. No user or application is trusted simply because it has previously authenticated or resides inside the corporate network.
Enforce least privilege

Every identity is granted the narrowest set of permissions needed. Broad, standing access rights are replaced with time-limited, task-scoped grants that automatically expire when the work is done.
Assume breach

Zero trust assumes attackers will eventually gain an initial foothold somewhere in an environment. Zero trust security controls are designed to limit lateral movement, reduce the blast radius of compromised credentials and contain attacks before they spread throughout the enterprise.

How zero trust works

Zero trust shifts security from a location-based model to an identity-centric one. Rather than granting access based on where a request originates, zero trust evaluates every request on its own merits. This identity-centric approach aligns with the principles of NIST Special Publication (SP) 800-207, one of the industry's most widely recognized zero trust frameworks.

Zero trust is not a single technology or solution. It is an operational model that verifies identities, continuously assesses risk and authorizes access to enterprise resources and data. Every access request follows the same basic process.

Authentication. Every request begins by verifying the identity of the user, machine or AI agent requesting access. Authentication confirms that the identity is legitimate before additional policy decisions are made.

Authorization. Zero trust analyzes contextual data such as device posture, user location, time of day and behavioral patterns to determine whether the action can be executed.

Least privilege access. Once trust has been established, access is granted according to the principle of least privilege (PoLP). Identities receive only the permissions required to perform a specific task.

Continuous monitoring and adaptive controls. Authorization does not end after login. Identity activity, device posture and contextual risk continue to be evaluated throughout the session. If conditions change, access policies can be adjusted automatically to reduce risk.

Capability	Function	How it relates to zero trust
Identity security	Discovers, governs and protects AI agents, humans and machine identities across the enterprise.	Identity is the foundation of zero trust. Every access decision begins by verifying the identity requesting access.
Least privilege access	Limits access to the minimum permissions required to perform authorized tasks.	Least privilege is a core zero trust principle that minimizes the impact of compromised accounts and credentials.
Just-in-time (JIT) access	Grants elevated privileges only when needed and automatically revokes them when the task is complete.	Supports zero trust by eliminating unnecessary standing privileges and reducing the attack surface.
Zero standing privilege (ZSP)	Eliminates permanent privileged access by requiring every privileged request to be explicitly approved and time-limited.	Extends zero trust by ensuring privileged access is continuously evaluated rather than permanently assigned.
Privileged Access Management (PAM)	Secures privileged accounts, credentials and administrative sessions.	PAM provides many of the controls used to implement zero trust for privileged users and administrators.
Zero trust network access (ZTNA)	Provides secure, application-level access based on verified identity, device posture and organizational policies instead of network location.	ZTNA applies zero trust principles to network access, replacing implicit network trust with continuous authorization.

Frequently Asked Questions

Is zero trust a product or framework?

Zero trust is a cybersecurity model based on the principle of "never trust, always verify." It is implemented through a combination of identity security, least privilege access, strong authentication and adaptive authorization, Privileged Access Management (PAM), identity governance and administration (IGA), zero standing privilege (ZSP), zero trust network access (ZTNA) and other complementary technologies.

Is zero trust the same as zero trust network access (ZTNA)?

No. Zero trust is a comprehensive security model that applies across users, devices, applications, cloud infrastructure and AI agents. Zero trust network access (ZTNA) is one technology used to implement that model by providing secure, identity-based access to applications without exposing the underlying network.

What is the difference between zero trust and identity security?

Identity security and zero trust are complementary but distinct concepts. Identity security focuses on discovering, governing and protecting human and non-human identities, including AI agents across the enterprise. Zero trust is a cybersecurity model that assumes no identity is inherently trusted and requires every access request to be authenticated, continuously authorized and monitored throughout the session. Identity security provides the visibility and controls needed to implement zero trust, while zero trust defines how access decisions about those identities should be made.

How does zero trust relate to Privileged Access Management (PAM)

Privileged Access Management (PAM) is a foundational technology for implementing zero trust. Modern PAM solutions enforce zero trust principles by vaulting privileged credentials and injecting them directly into applications at runtime. They provide just-in-time access, eliminating unnecessary standing privileges, continuously monitoring and authorizing privileged sessions. Together, zero trust and PAM help ensure that privileged access is granted only when needed, limited to the minimum permissions required and continuously evaluated throughout each session.

What is zero trust extended (ZTX)?

Zero trust extended (ZTX) is a framework developed by Forrester Research in 2017 that expanded the original zero trust model beyond network segmentation into seven pillars covering networks, data, people, workloads, devices, analytics and automation. ZTX made zero trust more prescriptive by giving organizations multiple starting points based on their risk priorities. While ZTX was influential in broadening how the industry thought about zero trust, it has been largely superseded by NIST SP 800-207, which has become the most widely adopted zero trust framework.

How is zero trust different from defense in depth?

Zero trust and defense in depth are complementary security strategies. Defense in depth uses multiple layers of security controls, such as firewalls, endpoint protection and network segmentation to protect enterprise systems. Zero trust focuses on authenticating and continuously authorizing identities based on policy and real-time contextual information. Together, they address different dimensions of the same problem. Defense in depth limits what an attacker can reach. Zero trust limits what a compromised or verified identity can do once it reaches that state.

How is zero trust different from least privilege and defense in depth? Isn't this just rebranding?

No. Least privilege and defense in depth are foundational security principles that predate zero trust. Zero trust builds on these concepts by requiring every access request to be authorized based on policy and real-time contextual information, and by continuously evaluating that authorization throughout the session. Rather than replacing existing security practices, zero trust unifies them into a continuous, identity-centric approach to controlling access.

Threat detection and mitigation

How does zero trust reduce ransomware exposure?

Zero trust reduces ransomware exposure by making it more difficult for attackers to gain, expand and maintain privileged access. By verifying identities, continuously enforcing least privilege and restricting lateral movement, zero trust limits an attacker's ability to reach critical systems and spread ransomware throughout the environment.

How does zero trust defend against supply chain attacks?

Zero trust helps defend against supply chain attacks by ensuring that AI agents, third-party users, applications and services receive only the minimum access needed to perform approved tasks. Every access request is authenticated and continuously authorized based on identity, device posture, behavioral patterns and other contextual factors. By eliminating unnecessary standing privileges and restricting lateral movement, zero trust limits the ability of compromised vendors, software or external identities to access sensitive systems or spread an attack across the environment.

How does zero trust relate to agentic AI security?

AI agents are non-human identities that require access to enterprise resources to perform work. Unlike traditional automation, they make autonomous decisions at runtime and can interact with multiple systems without human oversight, making access governance especially important. Like human users, they can be compromised or misused if granted excessive permissions. Zero trust secures AI agents by authenticating every identity at the point of access, continuously authorizing and adjusting what agents are permitted to do throughout the session based on policy and real-time contextual information.

Implementation and compliance

Does zero trust help with regulatory compliance requirements?

Yes. In the U.S., NIST SP 800-207 defines the Federal zero trust architecture (ZTA) standard and is the most widely referenced framework for zero trust implementation. U.S. Federal agencies are required to adopt ZTA under OMB Memorandum M-22-09. NIST SP 800-53 access control requirements align directly with zero trust, least-privilege and continuous authorization controls. SOC 2, PCI DSS, HIPAA and ISO 27001 all include access control requirements that a zero-trust implementation satisfies or exceeds.

What is the difference between zero trust and a VPN?

A VPN grants remote users access to a network, then relies on network controls to govern what they can reach. Zero trust grants users direct access to specific authorized resources rather than to the network itself. A VPN-compromised credential gives an attacker broad network visibility. A zero trust model limits exposure.

Does zero trust eliminate the need for a firewall or network security?

No. Zero trust complements rather than replaces traditional network security controls. Firewalls, network segmentation and traffic inspection remain important components of a defense in depth strategy. The difference is that zero trust does not rely on the network perimeter as the primary trust boundary. Instead, it verifies identities and continuously authorizes every access request based on identity, context and risk, regardless of where the request originates.

Where should you start with zero trust?

Begin with core identity security controls, including Privileged Access Management and least privilege enforcement. Prioritize privileged access, since privileged accounts pose the greatest risk if compromised. From there, expand zero trust incrementally across applications, cloud infrastructure and non-human identities, extending identity governance and access controls to AI agents, human and machine identities as your program matures.

Does zero trust require ripping out existing infrastructure?

No. In most cases, you can extend existing identity, security and IT infrastructure to support zero trust. Rather than replacing technologies, zero trust strengthens them by adding strong authentication, adaptive authorization and least privilege controls. Many organizations begin by securing privileged access, then expanding zero trust across applications, cloud infrastructure, non-human identities and AI agents.

How do you apply zero trust principles to legacy systems and infrastructure that can't support modern identity protocols?

Zero trust can be applied incrementally without replacing legacy systems. In most cases, you can extend zero trust to legacy applications and infrastructure by placing modern access controls, such as Privileged Access Management or a secure access proxy, in front of them. This approach helps enforce least privilege, reduce risk and extend zero trust coverage as infrastructure is modernized over time.

How does zero trust affect user experience and productivity? What's the tradeoff?

When implemented well, zero trust improves security without creating unnecessary friction for users. Strong authentication verifies identity at the start of a session, while continuous authorization evaluates access in the background based on policy and real-time contextual information. Low-risk activities proceed seamlessly, while higher-risk requests may require additional verification, approval or restricted access. Poorly designed implementations can introduce friction, but this is typically a policy tuning problem rather than an inherent limitation of the model. The goal is to make security invisible to users performing legitimate work while maintaining strict controls over high-risk access.

What are the most common reasons zero trust initiatives stall or fail?

Zero trust initiatives often stall when organizations treat them as a one-time technology deployment rather than an ongoing strategy. Some organizations struggle to remove broad-standing privileges because of pressure to keep systems running without disruption. Others define policies centrally but fail to enforce them consistently across cloud, legacy and third-party environments. Starting too broadly is also a common mistake. The most successful implementations start small, focusing on privileged access and high-value systems, then expand from there.

Is zero trust ever the wrong fit, or does it apply to every organization regardless of size/maturity?

The principles of zero trust apply to organizations of any size, but implementation should be tailored to the organization's risks, priorities and available resources. Every organization, regardless of size, should start by prioritizing its most critical identities, systems and access pathways, then expand zero trust coverage incrementally over time.