GLOSSARY

A security model that requires continuous verification of every user, device, and network flow — regardless of location — before granting access to resources.

As organisations adopt cloud infrastructure, remote work, and third-party integrations, traditional perimeter-based security becomes insufficient. Zero Trust reduces the blast radius of breaches, limits lateral movement by attackers, and supports regulatory compliance frameworks that require granular access controls. It is particularly critical for organisations handling sensitive data, operating in regulated industries, or managing complex supply chains.

An enterprise migrating to multi-cloud infrastructure implements Zero Trust by deploying an identity-aware proxy in front of all internal applications. Employees authenticate through a centralised identity provider with device health checks, and access policies are enforced per-application based on role, device posture, and risk signals — regardless of whether the user is on the corporate network or working remotely.

Zero Trust is an architectural philosophy, not a single product. Full implementation requires significant investment in identity infrastructure, network redesign, and ongoing policy management. Legacy applications that cannot support modern authentication protocols may require additional adaptation layers. The "zero trust" label is frequently used in marketing without substantive architectural change.

Zero Trust eliminates the concept of a trusted internal network. Instead of assuming that entities inside a perimeter are safe, every access request is authenticated, authorised, and encrypted in real time. The architecture relies on identity-aware proxies, micro-segmentation, least-privilege access policies, continuous posture assessment, and telemetry-driven policy enforcement. Core principles include "never trust, always verify", least-privilege access, and assume-breach mindset. Implementation typically involves identity providers, policy engines, enforcement points, and security information and event management (SIEM) integration.