What is Zero Trust?
A security model that trusts no request by default — every access is authenticated, authorized, and encrypted regardless of network location.
Definition
Zero trust discards the castle-and-moat assumption that traffic inside the corporate network is safe. Every request — from an office desk or a coffee shop — must prove identity and device posture, receive least-privilege authorization, and travel encrypted. The model, formalized in NIST SP 800-207 and popularized by Google's BeyondCorp, replaces broad VPN access with per-application policy decisions based on user, device health, and context. In infrastructure, mutual TLS between services (enforced by meshes like Istio) and short-lived credentials apply the same principle to machines. The mantra: never trust, always verify, assume breach.