Which statement best defines zero trust as a security model?
Choose an answer, then check it.
Cybersecurity · Foundations
Zero Trust Basics
On this page 9 sections
In 30 seconds
zero trust A security model in which no user or device is trusted by default, inside or outside the network, and every access request must be verified before access is granted. Full entry → is a security model in which no user or device is trusted by default, inside the network or outside it. Every access request A single attempt by a user or device to reach a resource, evaluated on its own merits rather than on the location it comes from. Full entry → is verified before access is granted, and trust is re-checked continuously. It is the opposite of the old perimeter model, which trusted everything inside the walls. Zero trust is an approach, not a single product, and organizations adopt it gradually.
Why this matters
The old model trusted whatever sat inside the network, so one compromised device gave an attacker free run of everything behind the wall. Zero trust removes that assumption: every request is decided on its own, wherever the user and device happen to be. It matters practically because remote work and cloud services have erased the boundary that perimeter security depended on, and it matters academically because it reframes security from a place to protect into a question to ask of every request — who is asking, and why should this be allowed? It also prepares you to read how organizations describe security today: most are working toward zero trust, not claiming to have finished it.
The college version
What zero trust is
Zero trust is a security model in which no user or device is trusted by default, whether it sits inside the network or outside it. NIST, in SP 800-207, frames the idea as the elimination of implicit trust Trust granted automatically because of a circumstance such as location, without verifying the request itself. Full entry →: zero trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location. Being on the company network no longer counts as a reason to be believed. The phrase most people meet first is 'never trust, always verify,' which Microsoft Learn uses as the one-sentence summary of the model: access is granted only after checking who is asking, what device they are using, and what the request looks like. NIST's fuller working definition describes zero trust as a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least-privilege, per-request access decisions in the face of a network viewed as compromised. The useful part for a learner is the shift: trust is no longer a property of a place; it is a property of each individual request.
The perimeter problem
The model zero trust replaces is the perimeter model, sometimes called castle-and-moat. Cloudflare's explainer describes it directly: it is hard to obtain access from outside the network, but everyone inside the network is trusted by default, and the problem is that once an attacker gains access, they have free rein over everything inside. NIST makes the same point: perimeter-based security is insufficient because once attackers breach the perimeter, further lateral movement The way an attacker, after gaining access to one device, tries to reach other devices and resources on the same network. Full entry → is unhindered. A device that gets past the wall is then believed everywhere, and an attacker who controls one laptop can drift toward the file server, the payroll system, and the backup appliance. The model also lost its geography. NIST notes that zero trust is a response to trends including remote users, bring-your-own-device, and cloud assets that no longer sit within an enterprise-owned boundary, and Microsoft observes that modern attacks rely on identity compromise rather than network location. When 'inside' can mean a coffee shop and a public cloud, a wall no longer marks where the safe zone begins.
The core principles
Zero trust rests on a small set of principles, and each one is one sentence. Verify every request: every access request is authenticated and authorized before access is granted, using all available signals. Limit access: every user and workload receives only the access it actually needs, for the shortest time required — the least-privilege principle, which has its own lesson in this course. assume breach Designing security controls on the expectation that attackers may already be inside the environment, so limiting the impact of a breach and detecting it quickly matter most. Full entry →: controls are designed on the expectation that attackers might already be operating inside the environment, so the focus is on limiting the impact of a breach and detecting it quickly. Never trust implicitly: no request is believed because of where it comes from; location, by itself, grants nothing. NIST's tenets spell out the same commitments in more technical form — all communication is secured regardless of network location, access to a resource is granted per session, and policy is dynamic, drawing on identity, device state, and behavior. Multifactor authentication often appears in this conversation; it is a verification tool that has its own lesson here, referenced rather than covered.
What zero trust is not — and what it looks like in practice
The most common misconception is that zero trust is a product. It is not. Cloudflare is explicit that zero trust is a holistic approach to network security that incorporates several different principles and technologies, and NIST describes its tenets as deliberately technology-agnostic. A vendor can sell tools that support the model — identity checks, access policy engines, monitoring — but no single appliance installs the model itself. In practice, zero trust shows up in three visible ways. Continuous verification: trust is not a badge you earn once; logins and connections time out and must be re-verified, and every request is assessed as conditions change. micro-segmentation Dividing a network into small, isolated zones so that a compromise in one zone cannot spread far through the rest. Full entry →: the network is divided into small, isolated zones so that a compromise cannot travel far — the network-segmentation lesson in this course covers that in depth. Strict access: access to each resource is granted per session, decided by policy that weighs who is asking, what device they are on, and whether the request fits normal behavior.
The honest framing
Zero trust is a philosophy, not a switch. CISA describes it as a shift from a location-centric model to a more data-centric approach, and notes that it may require a change in an organization's philosophy and culture around cybersecurity. That is why CISA publishes a Zero Trust Maturity Model: a roadmap that agencies and organizations use as they transition, with maturity levels that run from traditional practices to initial, advanced, and optimal. The honest way to read a company's statement that it uses zero trust is as a direction of travel, not a finished state. Most organizations adopt the model gradually — tightening verification on the most sensitive resources first, shrinking the zones, and expanding from there. The goal is not a perfect system; it is a system in which no request is believed without being checked.
Eli explains
The same idea, in plain words
Explain it like I’m 10
The old way of protecting a building was one guard at the gate: get past the gate and you could walk anywhere inside. Zero trust says there is no 'inside.' Every door checks your badge again — the front door, the office door, the server-room door — and the checks keep happening, because a badge can be lost or stolen at any moment. Nobody gets a free pass just for being in the building already. That is the whole idea: trust is not a place you stand; it is a check that happens before every step.
Picture it like this
Think of a museum with a guard at the door of every gallery. Your ticket gets you through the front door, but it does not get you into the restoration lab: the guard there asks for a second credential, and every doorway means another check. A visitor who slips past the front desk still cannot wander into the vault, because each door re-checks. Zero trust treats every resource like a separate gallery with its own door, and the doors stay locked until the check passes.
Where the picture stops working
The analogy is kinder than reality in one way and harsher in another. Museum guards check people at physical doors, while zero trust checks software requests — millions of them a day — using signals like device health and behavior, which the museum never sees. And a guard can be waved through by a supervisor, while zero trust rules are enforced by software: consistent, but only as good as the rules someone wrote and the evidence the system collects.
Worked example
Dover Line, a regional bus company, used to trust anything inside its office network. When a ticket kiosk at one depot was compromised, the attacker moved from the kiosk to the scheduling database at headquarters, because nothing inside the wall re-checked. The company then moved to zero trust. Every request to the scheduling database is now verified — who is asking, from which device, and whether that device is healthy — regardless of whether the request comes from a depot, headquarters, or a dispatcher's home office. A kiosk that gets compromised can no longer reach the database with its old credentials, because the request no longer carries the location it used to rely on, and access is granted per request rather than per network.
Key takeaway
Zero trust is the security model that grants no implicit trust: every access request is verified, access is limited, and breach is assumed. It is an approach adopted gradually — a philosophy, not a switch — and not a product to be installed.
Quick check
3 questions here, of 5 in this lesson’s practice set. Answers stay hidden until you check.
Why did the traditional perimeter model — trusting everything inside the network — break down?
Choose an answer, then check it.
A hospital employee opens a work document from the hospital's internal file server while sitting in the hospital café. Under a zero trust approach, what should happen?
Choose an answer, then check it.
Study tools & related lessonsYou’ll learn to · Common mistakes · Easily confused · Key vocabulary · Related
You’ll learn to
- Define zero trust as a security model in which no user or device is trusted by default, inside or outside the network, and every access request must be verified.
- Explain why the traditional perimeter model broke down, including unhindered lateral movement and resources that no longer sit inside the network boundary.
- State the core zero trust principles: verify every request, limit access, assume breach, and never trust implicitly.
- Distinguish zero trust as an approach from the misconception that it is a single product.
- Apply zero trust thinking to everyday access decisions, including continuous verification, micro-segmentation, and strict per-session access.
- Analyze the honest framing that zero trust is adopted gradually, not switched on.
Common mistakes
Zero trust is something you buy.
Zero trust is not a single product; it is an approach built from several principles and technologies. Tools can support it, but no appliance installs the model by itself — Cloudflare describes it as a holistic approach, and NIST keeps its tenets technology-agnostic.
Zero trust means trusting nobody, so employees are treated as suspects.
Zero trust removes implicit trust, not all trust. Legitimate users are verified and granted access per request; the model is strict about checking, not about assuming people are dishonest.
Being inside the network still counts as a reason to trust.
Location is exactly what zero trust stops using as a trust signal. NIST is explicit: requests from inside the legacy perimeter must meet the same security requirements as requests from anywhere else.
Zero trust is a switch you flip in a weekend.
Adoption is gradual. CISA's Zero Trust Maturity Model describes a transition from traditional to optimal practices, and CISA notes that zero trust may require a change in an organization's philosophy and culture.
Zero trust is the same thing as MFA or network segmentation.
Those are sibling topics and useful components, but they are pieces, not the model. Zero trust is the overall approach that decides when those pieces are required.
Easily confused
Perimeter model vs. Zero trust
The perimeter model trusts by location: inside the wall is safe, outside is not. Zero trust withholds implicit trust from every request and verifies each one, wherever it comes from.
Implicit trust vs. Verified trust
Implicit trust is granted automatically because of a circumstance like location; verified trust is earned per request through authentication and authorization.
Zero trust (the model) vs. Least privilege (the practice)
Least privilege limits how much access an identity gets — one principle inside the model; zero trust is the broader approach that also includes verification, assume breach, and continuous re-checking. Least privilege has its own lesson in this course.
Key vocabulary
- zero trust
- A security model in which no user or device is trusted by default, inside or outside the network, and every access request must be verified before access is granted.
- implicit trust
- Trust granted automatically because of a circumstance such as location, without verifying the request itself.
- network perimeter
- The boundary the traditional security model defended; everything inside it was assumed to be safe, and everything outside it was treated as a threat.
- lateral movement
- The way an attacker, after gaining access to one device, tries to reach other devices and resources on the same network.
- verify explicitly
- The principle that every access request is authenticated and authorized before access is granted, using all available signals about the requester.
- assume breach
- Designing security controls on the expectation that attackers may already be inside the environment, so limiting the impact of a breach and detecting it quickly matter most.
- micro-segmentation
- Dividing a network into small, isolated zones so that a compromise in one zone cannot spread far through the rest.
- access request
- A single attempt by a user or device to reach a resource, evaluated on its own merits rather than on the location it comes from.
Sources & references
- NIST SP 800-207: Zero Trust Architecture — National Institute of Standards and Technology (NIST)
- Zero Trust Maturity Model (CISA) — Cybersecurity and Infrastructure Security Agency (CISA)
- Zero Trust overview — Microsoft Learn
- What is Zero Trust security? (Cloudflare Learning Center) — Cloudflare
EliExplains lessons are original prose written from the open, credible references above. See Copyright & Licensing.
Researched 2026-08-21
Educational content only. It is not medical, legal or professional advice. Found an error? Tell us.