What is zero trust?
Zero trust is a security principle that trusts no one automatically — every access must be verified.
TL;DR
- Zero trust is a security model that applies strict verification to every access request, regardless of location or device — never trust, always verify.
- It replaces implicit network trust with explicit verification and least-privilege access.
- Zero trust reduces the impact of stolen credentials and compromised vendors.
Short definition
Zero trust is a security model that applies strict verification to every access request, regardless of location or device, based on the principle of never trust, always verify.
How does zero trust replace the perimeter model?
Older models relied on the network perimeter: anyone inside was considered safe. Zero trust removes that assumption — layered authentication, least-privilege authorization, and access segmentation are applied to every resource.
Zero trust is also relevant to third-party risk: vendor connections to internal systems should be limited and monitored rather than fully trusted. Security ratings help assess how trustworthy an external party is before access is granted.
What are some practical examples?
- Vendor access to production systems is limited to the necessary modules and monitored.
- Multi-factor authentication is mandatory for all remote access.
- Separate network segments for payment systems and office systems.
Learn more
Frequently asked questions
Related terms
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating