# What Is Zero Trust?

Source: https://startwithidentity.com/guides/fundamentals/what-is-zero-trust/
Last updated: 2026-10-17
License: content by Start with Identity. Cite the source URL.

---

Zero Trust is a security model that assumes no user, device, or network is trusted by default. Instead of a hard perimeter with a soft interior, every access request is verified explicitly using identity, device posture, and context, and is granted with the least privilege necessary.

## The core principles

- **Verify explicitly:** authenticate and authorize every request on signals like identity, device health, location, and risk.
- **Least privilege:** grant the minimum access needed, ideally [just in time](https://startwithidentity.com/guides/fundamentals/what-is-pam/).
- **Assume breach:** segment, monitor, and limit blast radius as if an attacker is already inside.

## Why identity is the foundation

Once the network is no longer the perimeter, **identity becomes the perimeter**. That is why Zero Trust programs lean on strong [authentication](https://startwithidentity.com/guides/fundamentals/authentication-vs-authorization/), phishing-resistant [MFA](https://startwithidentity.com/vendors/mfa/), continuous [authorization](https://startwithidentity.com/guides/fundamentals/rbac-vs-abac-vs-rebac/), and [identity threat detection](https://startwithidentity.com/vendors/itdr/).

## Zero Trust Network Access (ZTNA)

ZTNA is the access-layer implementation that replaces VPNs with identity-aware, per-application access. Browse [Zero Trust vendors](https://startwithidentity.com/vendors/zero-trust/), compare the top [zero trust network access tools](https://startwithidentity.com/articles/top-8-zero-trust-network-access-tools/), and read our [zero-trust rollout guide](https://startwithidentity.com/guides/implementation/zero-trust-rollout/).

## What "implementing zero trust" actually means

Zero trust is a set of principles, not a product, and vendors sell very different things under the label. In practice a programme is four workstreams:

1. **Strong authentication everywhere.** [Phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) with a short exemption list that is reviewed, not inherited. Policies that require "MFA" generically are satisfied by methods that relay kits defeat daily.
2. **Device signal in the access decision.** [Device posture](https://startwithidentity.com/glossary/device-posture/) from MDM or EDR, feeding [conditional access](https://startwithidentity.com/glossary/conditional-access/). This is the workstream most often skipped because it requires enrolment on every endpoint.
3. **Per-application authorization.** [ZTNA](https://startwithidentity.com/glossary/ztna/) replacing flat network access, so a compromised endpoint reaches only what its user is entitled to.
4. **Continuous evaluation.** Re-checking during a session rather than only at the gate, because a session stolen after login satisfied every policy at issuance.

## The honest limits

Two things are worth saying plainly. Device posture is self-reported by software on a machine an attacker may already control, so it is strong against commodity attacks and weak against a determined intruder holding the device. And the hardest part of most ZTNA migrations is not technology, it is producing an inventory of every internal application, who should reach it, and which ones depend on flat network access today.

NIST SP 800-207 is the reference worth reading precisely because it is vendor-neutral enough to argue with.

## Where zero trust fails in practice

Exclusions. Every real deployment accumulates policy exemptions added for a migration, a vendor, or a legacy application, and they are never removed. Audit the exclusion list more often than the policy list, because that is where the actual access model lives.

## Where to start

Read the [Zero Trust architecture guide](https://startwithidentity.com/guides/architecture/zero-trust-architecture-implementation-guide/), then map your identity stack against the principles above.