Zero trust has been a security industry buzzword for so long that the meaning has eroded. Vendors sell “zero trust” products. Analysts publish “zero trust” maturity models. CISOs talk about being “on a zero trust journey.” Most of it is noise.
The actual idea is simple, and it predates the marketing. Stop trusting the network as a security boundary. Verify every request based on identity, device, and context — every time.
That’s the whole concept. Everything else is implementation detail. But the implementation details are where organizations get stuck.
Identity is the new perimeter
If your security model still depends on “users behind the VPN are trusted,” you don’t have a zero trust architecture. The corporate network shouldn’t grant access to anything; it should be a transit network like any other.
The first practical step is making identity strong enough to carry that weight:
- Phishing-resistant MFA on every account that matters
- Conditional access policies tied to device posture
- Just-in-time elevation for privileged operations
- Eliminate shared accounts everywhere they exist
If identity is weak, the rest of the architecture is theater.
Device posture is the second pillar
Identity tells you who is making a request. Device posture tells you from where and under what conditions. Without device posture, an attacker with a valid password and an MFA bypass can access anything the user can access.
Practical device posture means:
- Managed devices with up-to-date OS and EDR
- Compliance state evaluated on every authentication
- Unmanaged device access scoped to a narrower permission set
- Browser-based access with session controls for the BYOD case
The goal isn’t to lock down every device — it’s to make access decisions that reflect the actual risk of the device making the request.
Microsegmentation is overrated
The vendor pitch for zero trust often centers on microsegmentation — dividing the network into hundreds of isolated zones with east-west traffic policies between them. For most organizations, this is the wrong place to start.
Microsegmentation is expensive, operationally complex, and has diminishing returns once identity and device posture are strong. We’ve seen multi-year microsegmentation programs deliver less risk reduction than a six-month identity hardening sprint at the same organization.
Get identity right first. Get device posture right second. Microsegment specifically where the data sensitivity justifies it. Don’t try to microsegment the whole network.
Plan for the gradient, not the binary
Real zero trust deployments are gradients, not switches. Different workloads will reach different maturity levels at different times. A reasonable maturity gradient looks like:
- Tier 1 (most sensitive): Strong identity, managed device required, session monitoring, just-in-time access
- Tier 2 (sensitive): Strong identity, device compliance check, standard session controls
- Tier 3 (general): Strong identity, posture-aware policies, baseline logging
- Tier 4 (public): Identity verification only
Most organizations have everything sitting at Tier 3 or below. Moving the right workloads up — not all workloads — is the actual transformation.
What to ignore
A few things you can safely deprioritize despite the marketing:
- Replacing your existing VPN with a “zero trust network access” product on day one
- Buying a unified zero trust platform that promises everything
- Microsegmenting workloads that already have strong access controls
- Anything that promises to deliver zero trust without you changing how you work
The honest answer
Zero trust takes years to implement well, and the work is mostly unglamorous. It’s identity hygiene, device management, careful policy work, and steady incremental improvement. The organizations that succeed don’t treat it as a project with a deadline — they treat it as a permanent shift in how access decisions get made.
The good news: every step on this path reduces risk on its own. You don’t need to finish to benefit.