Zero Trust Explained Without the Buzzwords

Zero trust is a way of designing security so that nothing and no one is trusted automatically, whether they sit inside your network or outside it.

Access is granted on verified identity, device status, how sensitive the resource is and policy, not on network location alone. It can be reassessed as conditions change.

This guide uses NIST, CISA and the US government's own documents to explain what zero trust means, its principles and pillars, and what zero trust network access is. Sources were checked on October 22, 2026.

The short answer

NIST describes zero trust as a set of ideas for making accurate, least-privilege access decisions one request at a time, in a network you assume may already be compromised.

It describes how you work, not something you can purchase.

In practice, that means strong sign-in, checks on the device, access limited to what a task needs, and constant monitoring.

Zero trust meaning

NIST's publication on zero trust architecture says zero trust assumes no implicit trust for an asset or a user account based only on where it is on the network, or on who owns the device.

A laptop inside the office gets no more automatic trust than one in a cafe. Both must prove who they are and meet the same security requirements before they reach a resource.

Why the old approach fails

This section is our analysis. Older designs trusted anything inside the company network, like a building where one badge opens every door. If an attacker gets in with one stolen login, they can move freely.

Zero trust removes that free movement. NIST's second tenet says network location alone does not imply trust, and that requests from inside a legacy perimeter must meet the same requirements as any other.

Question	Perimeter thinking	Zero trust thinking
Who is trusted?	Anyone inside the network	No one by default
What triggers a check?	Signing in once	Each request
How much access?	Broad, once inside	Least privilege for the task
If a device is compromised	It can roam widely	Its reach is limited

The table is our summary of NIST's tenets, not an official comparison.

Zero trust principles

NIST's SP 800-207 lists seven tenets. This table puts each in plain words.

Tenet	In plain words
1	Treat all data and services as resources to protect
2	Protect every communication path, whatever network it travels on
3	Give access for one session at a time, limited to what the task needs
4	Base access on dynamic policy that weighs identity, application and device state
5	Watch the security state of every asset you own or use, and trust none of them by default
6	Check identity and permission, and enforce both strictly, before granting access
7	Gather as much data as you can about assets and traffic, and use it to strengthen security

The wording is our paraphrase of NIST's text. Read the publication itself for the full detail behind each tenet.

Zero trust architecture

NIST's glossary defines a zero trust architecture as an organization's cybersecurity plan built on zero trust ideas, including how components relate, how workflows are planned and which access policies apply.

The resulting network and operating policies make up what NIST calls a zero trust enterprise. In other words, the architecture is the design, and the enterprise is what you end up running.

Zero trust model and zero trust security

The words model, architecture and strategy get mixed up. NIST's glossary uses all three: it calls the approach a security model, a group of design principles and a joined-up cybersecurity and system management strategy.

So zero trust security is not one tool. It is a design approach that assumes the network is hostile and makes the access decision at the resource itself.

Zero trust pillars

Version 2.0 of CISA's Zero Trust Maturity Model arranges the work around five pillars and three capabilities that cut across them. It also describes four stages: traditional, initial, advanced and optimal.

Pillar	What maturity looks like	Example (our illustration)
Identity	Verifying and authenticating users	Phishing-resistant MFA on every account
Devices	Moving from little visibility into device compliance to continuously verifying and enforcing it	Only managed, up-to-date devices reach sensitive apps
Networks	Micro-segmentation, dynamic rules, encrypted traffic where appropriate and least privilege	Separate zones, so a breach in one stays there
Applications and workloads	Granular access controls for both on-premises and cloud applications	Each app checks who is asking and what they may do
Data	Access controls that consider identity, device risk and the kind of data	Sensitive files open only to approved users on healthy devices

The three cross-cutting capabilities are visibility and analytics, automation and orchestration, and governance. CISA calls its model one of many roadmaps, so treat it as a guide and not a checklist.

Zero trust network access

Zero trust network access, or ZTNA, takes the same ideas and applies them to remote access.

This is our explanation: instead of connecting a user to a whole network, it connects them to a specific application after checking who they are and what device they use.

I did not find an official NIST definition of ZTNA, and vendors define it differently. When you compare products, ask what each one checks before it grants access, and what it does after.

ZTNA commonly connects people to specific applications or resources instead of exposing a whole internal network, but implementations differ.

Application-only access is not zero trust by itself. Identity, device checks, authorization and monitoring still matter, and NIST's architecture is about protecting resources, not just replacing a VPN.

Zero trust network

A zero trust network is built on the assumption that an attacker could already be inside. In CISA's model, the networks pillar points toward segmenting it into small zones and encrypting traffic.

The aim is to limit how far a single compromised device or account can reach, so one stolen login does not open everything.

What the US government requires

In January 2022, the Office of Management and Budget issued memorandum M-22-09, a federal zero trust strategy. It set objectives for agencies to meet by the end of fiscal year 2024, a deadline that has now passed.

These were federal agency requirements, not rules for private companies or home users.

The memo required strong multifactor authentication enforced at the application layer, and phishing-resistant MFA for staff, contractors and partners. It also told agencies to consider at least one device signal alongside user identity.

One detail helps everyone: the memo said password policies must not demand special characters or routine rotation. Our guide to MFA methods explains why phishing-resistant methods matter.

How to start

This part is our advice, based on the sources above.

A worked example

Treat this as an illustration, not a walkthrough of any product. Picture an employee opening a payroll app from a cafe on a personal laptop.

The system checks the sign-in method, the state of the laptop and how sensitive the data is. It grants access to that app only, for that session, and logs the request.

If the laptop is out of date or the sign-in looks unusual, the request can be refused or limited. That decision is made per request, not per network.

Try microsegmentation yourself

Microsegmentation means splitting a network into small zones and allowing only the connections each zone needs. CISA published a guide called Microsegmentation in Zero Trust, Part One: Introduction and Planning in July 2025, and says any organization can apply it.

To see the idea working, I built a tiny network on a Linux machine with three isolated hosts: a web server, an app server and a database.

A fourth address stood in for the internet. First I left everything open, the way many flat networks start.

=== BEFORE: flat network, no rules ===
internet -> web:443     open
internet -> app:8080    open
internet -> db:5432     open
web -> app:8080         open
web -> db:5432          open
app -> db:5432          open

Every path works, including the ones that should never exist. The internet can reach the database directly, and the web server can reach it too. If an attacker takes over the web server, the database is one hop away.

Then I applied default deny on each host and added one rule per real need.

The web server accepts connections from anywhere on port 443, the app server accepts only the web server on port 8080 and the database accepts only the app server on port 5432.

=== AFTER: default deny, one explicit allow per service ===
internet -> web:443     open
internet -> app:8080    BLOCKED
internet -> db:5432     BLOCKED
web -> app:8080         open
web -> db:5432          BLOCKED
app -> db:5432          open

The three paths the application needs still work. The three it never needed are closed. A compromised web server can now reach the app server, but not the database. The database host's firewall shows how small the rule set is.

-P INPUT DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s 10.0.0.3/32 -p tcp -m tcp --dport 5432 -j ACCEPT

The first line drops everything by default. The last allows one source to one port. That pair is the heart of zero trust at the network layer: no implicit trust based on location, and an explicit allow for each flow.

What the demo leaves out

This was a simple test on one machine, with address-based rules. Real zero trust adds identity, because an address says little about who or what is connecting.

The NIST publication on zero trust architecture says authentication and authorization of both the subject and the device are discrete functions performed before a session to a resource is established.

So treat the firewall rules as the network layer of a larger design. Our guides to single sign-on, MFA methods and privileged access management cover the identity layer.

Three principles to remember

Microsoft's zero trust overview boils the model down to three principles. Verify explicitly: authenticate and authorize each request using every signal you have.

Use least privilege access: give users and workloads only what they need, for as short a time as they need it.

Assume breach: design controls on the expectation that attackers may already be inside, so they concentrate on containing damage and spotting trouble fast.

The demo above is an assume-breach control, because it limits what a compromised web server can reach.

Maturity: you do not switch it on

CISA's maturity model says that within each pillar it gives examples of traditional, initial, advanced and optimal zero trust architectures. It lists five pillars and three cross-cutting capabilities, and version 2.0 aligns with OMB memorandum M-22-09.

The practical lesson is that zero trust is a journey with stages. Most organizations start at traditional and move pillar by pillar. You can be advanced on identity and still traditional on networks, which is normal.

A first 90 days

This plan is our suggestion for a small or midsize organization. It favors steps that lower risk quickly.

Common challenges

Zero trust projects stall for predictable reasons. These are the usual ones, with our suggested response.

Zero trust for a small business

You do not need a large budget. Most of the benefit comes from basics: multifactor authentication on every account, separate administrator accounts, up-to-date devices, one sign-in system and default-deny rules around your most valuable data.

Our phishing guide and our social engineering guide cover the human side, because stolen credentials and tricked users are how many attackers get past the front door.

How to measure progress

Track a few numbers each quarter. These are our suggestions.

Common mistakes

This section is our advice. Do not buy a product and call the job done. Do not skip the inventory of what you are protecting. Do not make rules so strict that people work around them.

Start with critical applications, privileged accounts and sensitive data, then expand based on risk and on how much you can realistically operate.

What zero trust does not mean

It does not mean trusting no one in a literal sense. It means trust has to be earned on every request and is limited in scope and in time.

It is also not a one-time project. NIST's fifth tenet calls for continuous monitoring, and CISA describes a staged journey. Expect to improve it in steps.

Zero trust does not eliminate phishing, compromised devices or insider threats. It aims to limit what those threats can reach and reduce the damage they cause.

Zero trust at home

This section is our analysis. A home user is not building a full enterprise architecture, but you can borrow the mindset: protect each account separately with MFA, keep devices updated, avoid reusing passwords and treat unexpected requests as suspect.

Our guides to phishing and social engineering cover the human side, which zero trust does not solve on its own.

Two building blocks are worth reading next. Our guides to single sign-on and privileged access management cover everyday logins and powerful accounts.

Frequently asked questions

What is zero trust in simple terms?

Trust nothing by default and verify everything. Each request is verified using identity, device and context, whatever network it comes from.

What are the principles of zero trust?

NIST lists seven tenets, including securing all communication, granting access per session with least privilege, and monitoring every asset.

What are the pillars of zero trust?

CISA's model has five: identity, devices, networks, applications and workloads, and data.

What is zero trust network access?

A remote access approach that connects users to specific applications after checking identity and device, rather than to a whole network. Definitions vary by vendor.

Is zero trust a product?

No. NIST describes it as concepts and ideas, and its architecture as a plan.

What is microsegmentation?

Splitting a network into small zones and allowing only the connections each zone needs, so a breach in one place cannot spread freely.

Does zero trust mean trusting nobody?

It means no implicit trust based on location or ownership. Access is decided per request using identity, device and context.

A quick checklist

• List your users, devices, apps and data.
• Turn on phishing-resistant MFA where possible.
• Give each account the least access it needs.
• Set rules for device health.
• Segment your network and monitor access.

Up nextMFA methods ranked from weakest to strongestStrong sign-in is the first practical step. Read our guide to MFA methods ranked from weakest to strongest.→