// strategy · guide

Zero Trust, Explained Without the Buzzwords

"Zero trust" is the most over-marketed phrase in security. Stripped of vendor spin, the idea is simple and genuinely useful.

The one sentence version

Do not grant trust solely because an account or device is inside a network or organisation. Authenticate and authorise access to resources using the relevant identity, device and risk context.

Why the old model failed

The traditional "castle and moat" assumed everything inside the firewall was safe. But remote work, cloud, and SaaS erased the walls, and one phished laptop inside the "trusted" network could reach everything. Attackers love flat, trusting internal networks.

What it looks like in practice

• Strong identity everywhere — strong authentication for people, with phishing-resistant MFA where supported, and appropriate workload-identity controls for services.
• Least privilege — people and services get the minimum access they need, and no more.
• Segmentation — a breach in one area can't freely reach the rest.
• Continuous verification — access decisions consider device health and context, not just a one-time login.

Pragmatic first steps for smaller teams

Start by identifying critical resources and their access paths. Improve identity, reduce unnecessary standing privilege, segment sensitive services and collect useful telemetry. These are starting points, not a quantified percentage of protection or a complete zero-trust architecture. The NIST SP 800-207 overview explains the resource-focused model.