What is Zero Trust?
A security model where no request is trusted by default — every identity, device, and network path must be verified regardless of its origin.
Full explanation
Zero Trust replaces the classic perimeter-security model ('inside the firewall = trusted') with continuous verification. Every request is authenticated, authorized, and logged, even from inside the corporate network. Implementations combine identity (strong auth + MFA), device trust (managed endpoints), network micro-segmentation, and runtime policy enforcement.
Example
A Zero Trust architecture requires every API call to present a valid short-lived token that encodes identity + device attestation, regardless of whether the call originates from the corporate VPN or the public internet.
Related
FAQ
Is Zero Trust a product?
No. It is an architectural principle. Products like Cloudflare Zero Trust, Zscaler, and Tailscale sell implementations.