Zero trust architecture: principles, not products

Zero trust is a security model that removes implicit trust based on network location - every access request is authenticated, authorised and continuously validated, regardless of where it comes from. It is an architectural approach, not a product, and no vendor can sell it to you in a box.

Why the perimeter model broke

Traditional security assumed a trusted inside and a hostile outside. Remote work, SaaS, cloud infrastructure and third-party integrations dissolved that boundary. Worse, the model failed catastrophically once breached: an attacker who got inside could move laterally with little resistance, because being on the network was treated as proof of legitimacy.

The core principles

• Verify explicitly. Authenticate and authorise using all available signals - identity, device health, location, workload, data sensitivity and behaviour.
• Least privilege. Just-enough and just-in-time access, with standing privilege minimised.
• Assume breach. Design as though an attacker is already inside: segment aggressively, encrypt end to end, and monitor everything.
• Continuous validation. Trust is re-evaluated during a session, not granted once at login.

The five pillars

1. Identity - strong authentication, phishing-resistant MFA, conditional access, privileged access management.
2. Devices - inventory, health attestation, compliance checks before access is granted.
3. Networks - micro-segmentation, encrypted transport, removing flat internal networks.
4. Applications and workloads - per-application authorisation rather than broad network access.
5. Data - classification, encryption and access decisions driven by sensitivity.

Cross-cutting all five: visibility and analytics, plus automation and orchestration to make policy enforceable at scale.

A realistic adoption sequence

Zero trust is a multi-year journey. The order matters more than the speed:

1. Identity first. Consolidate to a single identity provider, enforce phishing-resistant MFA everywhere, and eliminate shared accounts. This delivers most of the early risk reduction.
2. Inventory devices and applications. You cannot write access policy for things you have not catalogued.
3. Kill standing privilege. Move administrators to just-in-time elevation with approval and logging.
4. Replace flat VPN access with per-application access based on identity and device posture.
5. Segment the network, starting around your most sensitive systems rather than everywhere at once.
6. Instrument and monitor so policy violations are visible and enforcement can tighten safely.

Where zero trust programmes go wrong

• Buying a "zero trust product" first. Tools implement principles; they do not substitute for architecture.
• Skipping identity hygiene. Micro-segmentation on top of weak authentication solves the wrong problem.
• Big-bang rollout. Enforcement without a pilot breaks business processes and destroys support.
• Ignoring service accounts. Machine identities usually outnumber humans and are the easiest lateral path.
• No measurement. Without baselines you cannot show progress or justify continued investment.

Zero trust is not a compliance framework, but almost everything it asks for - MFA, least privilege, segmentation, monitoring, encryption - is already required by ISO 27001, the NCA ECC, SAMA CSF and NIST. Done deliberately, the architecture work and the compliance work are the same work.

Key takeaways

• Zero trust removes implicit trust based on network location.
• Verify explicitly, enforce least privilege, assume breach, revalidate continuously.
• Start with identity - it delivers the biggest early risk reduction.
• The work doubles as evidence for controls your frameworks already require.