What Is Zero Trust? The Principles, Pillars and Limits

Somebody has told your organization to do zero trust. It came from a customer's security questionnaire, an insurance renewal, or a board paper that used the phrase without defining it. Then the shopping starts, every vendor in the market turns out to sell a zero trust product, and none of them agree on what they are selling. That confusion is not your fault. Zero trust is an architectural principle published by the federal government, and almost everything sold under the name implements one slice of it.

What Is Zero Trust?

The authoritative definition is not a vendor's. NIST published Special Publication 800-207, Zero Trust Architecture, and its abstract states the idea in one sentence: zero trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location, or based on asset ownership. Being inside the building earns nothing. Being on a company laptop earns nothing. The credential and the device have to prove themselves on each request.

What that replaces is the model most networks were built on, where a hard shell protects a soft interior. NIST is blunt about why it stopped working: perimeter-based network security has been shown to be insufficient because once attackers breach the perimeter, further lateral movement is unhindered. One successful social engineering call puts an attacker on the inside, and on the inside everything looks like a colleague.

Two changes made the shell impossible to maintain anyway. The data left, into cloud services that a perimeter firewall never sits in front of. The people left, onto home networks and personal phones. Verizon's 2026 Data Breach Investigations Report found that breaches involving a third party now account for 48 percent of all breaches, a 60 percent jump in a year, which is another way of saying that half of the damage now arrives through a relationship rather than through a border.

So zero trust moves the protection to the thing being protected. In NIST's phrasing, it focuses on protecting resources, not network segments, because network location is no longer the prime component of a resource's security posture.

How Does Zero Trust Work?

An access decision in a zero trust architecture is made by three logical parts, all named in SP 800-207. The policy engine decides whether to grant, deny or revoke access, using enterprise policy plus signals from other systems. The policy administrator carries out the decision by opening or shutting the communication path. The policy enforcement point is the thing actually standing in front of the resource, enabling, monitoring and eventually terminating the connection.

Three details in that diagram do the real work. Access is granted per session, so authenticating to one resource does not hand over another. The decision is dynamic, drawing on the identity, the device's software versions and patch state, the time, the location and previously observed behavior, rather than on a static group membership set three years ago. And the evaluation continues after the session opens, which is why row seven exists.

This is also why multi-factor authentication is a component of zero trust rather than a synonym for it. NIST's sixth tenet expects MFA for access to some or all enterprise resources, but MFA answers only the first question, which is whether the person is who they claim. Zero trust keeps asking what that person should reach, from which device, for how long.

What Are the Three Tenets of Zero Trust?

The three most people are taught are verify explicitly, use least privilege access, and assume breach. Verify explicitly means every request is authenticated and authorized on all available signals. Least privilege means an account gets only the access its job needs, for the shortest useful time. Assume breach means the controls are designed on the expectation that an attacker is already operating inside, so the job is limiting the blast radius rather than keeping everyone out.

Now the part that causes the confusion. Searchers ask for three tenets, five pillars and seven tenets, and all three counts are correct, because they come from different documents describing the same model at different resolutions.

NIST's seven are worth reading once, because they are more specific than any summary: all data sources and computing services count as resources; all communication is secured regardless of network location; access is granted per session; access is determined by dynamic policy; the enterprise monitors the integrity and security posture of all owned and associated assets; all authentication and authorization is dynamic and strictly enforced before access; and the enterprise collects as much information as it can about the current state of assets and uses it to improve policy.

What Are the Five Pillars of Zero Trust?

The five pillars come from CISA's Zero Trust Maturity Model version 2.0, published in April 2023. They are identity, devices, networks, applications and workloads, and data. Running across all five are three cross-cutting capabilities: visibility and analytics, automation and orchestration, and governance.

The model's real contribution is that it is a maturity model rather than a checklist. Each pillar is scored across four stages, traditional, initial, advanced and optimal, on CISA's published scale. That matters because it gives an honest answer to "are we zero trust yet", which is no, and never entirely, and the useful question instead is which pillar is furthest behind.

For most organizations the answer is identity, and that is where the work should start. An organization at the traditional stage on identity is one where passwords still work on their own, where leavers keep their accounts for weeks, and where administrators use the same account for email and for changing permissions.

Zero Trust vs VPN

This is the comparison people actually want, because a VPN is the thing they already own. The distinction is what the successful connection grants you.

That does not make VPNs worthless. A VPN is still a reasonable answer for a small office with a handful of internal systems and no capacity to run an access platform, and NIST expects most enterprise infrastructures to operate in a hybrid zero trust and perimeter mode for a long time. The failure mode to avoid is a VPN that grants everyone full network membership and is treated as the security control rather than as a transport.

What Are the Disadvantages of Zero Trust?

SP 800-207 devotes an entire section to the threats a zero trust architecture introduces, which is more honesty than most vendor pages offer, and it is the best available answer to this question.

The first is subversion of the decision process. The policy engine and policy administrator become the most valuable systems in the organization, because no communication happens without their approval. An administrator with access to the policy rules can quietly grant themselves anything, and a compromised policy administrator can approve access that would otherwise be refused. NIST's mitigation is that every configuration change is logged and audited.

The second is the single point of failure. If an attacker denies access to the enforcement points or the policy engine, or a cloud provider hosting them has an outage, enterprise operations stop. Replication helps and does not eliminate the risk.

The third is that stolen credentials still work inside their scope. Zero trust stops an attacker with a valid account from moving beyond that account's normal purview, and a contextual policy is more likely to spot the anomaly than a flat network is. But an attacker holding a genuine credential and a genuine managed device can still reach what that person was entitled to reach.

The fourth is lost visibility. In an architecture where everything is encrypted by default, a large share of traffic becomes opaque to network inspection, so detection has to move to metadata and endpoint telemetry instead. Add CISA's own finding that legacy systems built on implicit trust require investment to change, and the honest summary is that zero trust is expensive, slow, and worth it in that order.

How to Implement Zero Trust

Nobody implements zero trust in one project. NIST's own practitioners published SP 1800-35, Implementing a Zero Trust Architecture, in June 2025, and it took 19 separate example builds with 24 collaborating organizations to cover the common cases. If it takes NIST 19 architectures, it will not take you one purchase order.

What a company without a security team can do, in this order, is unglamorous and cheap.