TL;DR
Zero Trust gets sold as a network strategy: segmentation, microsegmentation, replace the VPN. That framing misses the point. The thing Zero Trust actually moves is the control point, and the control point is identity. Every request is an identity making a claim that has to be verified in context, every time. Once you see it that way, the next question writes itself: most of the identities in your environment are not human.
The reframe
Read enough vendor pages and you will think Zero Trust is about the network. Segment the LAN, inspect east-west traffic, shrink the blast radius. All useful. None of it is the center of gravity.
John Kindervag named Zero Trust at Forrester in 2010 on one observation: trust is a vulnerability. The old model drew a perimeter at the network edge and trusted everything inside it. The implicit assumption was that a user’s identity behind the firewall was not compromised. That assumption is the bug. Once an attacker is inside, they are inside as a trusted identity, and they move laterally. The point of infiltration is rarely the target. The phished mailbox is not the prize. It is the entrance.
NIST formalized this in SP 800-207. Strip the document to its spine and you get a loop: a Policy Decision Point evaluates every request against policy, and a Policy Enforcement Point allows or denies it. The input to that decision is an identity, a context, and a resource. The network is one signal among many. It is not the boundary anymore.
So the boundary moved. It used to sit at the network edge. Now it sits at the identity layer, at the moment a subject asserts who it is and asks for something. That is what “identity is the perimeter” means as an architecture statement, not a slogan. The perimeter is wherever an access decision gets made, and that decision is an identity decision.
The mental model
The old model trusts a location.
In the old model, getting inside the zone is the whole game.
The new model verifies a claim.
In the identity model there is no inside. Each request stands on its own: who is asking, what do we know about them right now, what exactly are they asking for, and what is the blast radius if we are wrong.
Four properties make that real:
- Strong authentication. Passwords are a shared secret, which means they are a stealable secret. Phishing-resistant factors close that gap. FIDO2 and passkeys bind the credential to the device and the origin, so a phished code is useless, for the single-device flow. The cross-device flow is weaker: scan a QR code to sign in on a device that does not hold the passkey, and a real attack (the PoisonSeed campaign, 2025) showed exactly how that breaks. Phish a real login page, relay the victim’s real QR code, and the victim completes a genuine, domain-bound ceremony against the attacker’s session, no FIDO vulnerability required. Restrict or proximity-gate cross-device sign-in if you want the phishing-resistance property to actually hold.
- Continuous evaluation. Authentication at login is a snapshot. Zero Trust wants the verb tense to be present continuous. Device posture, session risk, impossible-travel signals, and behavior all feed the decision after login, not just at it.
- Least privilege, expressed as policy. RBAC was the floor. Attribute- and policy-based access control let the decision depend on context, not just a static role. The grant is scoped to the request and nothing more.
- Assume breach. Design as if an identity is already compromised. That single assumption is what kills implicit trust and forces every other property into existence.
Misconceptions worth killing directly
“Zero Trust is a product.” It is an architecture and an operating discipline. You can buy components. You cannot buy the model. A vendor selling you “Zero Trust in a box” is selling you one PEP and calling it the building.
“Zero Trust is microsegmentation.” Segmentation is a network tactic that supports Zero Trust. It is not Zero Trust. You can microsegment a network to dust and still hand out long-lived admin credentials with no step-up. That is a well-partitioned trust problem.
“We turned on MFA, so we’re Zero Trust.” MFA is necessary and nowhere near sufficient. Not all MFA is equal, either: phishing-resistant factors close the login gap. SMS codes and push prompts do not. Both have been defeated repeatedly, through MFA fatigue and SIM-swap attacks. Even the phishing-resistant kind only hardens one moment, the login. Zero Trust is about every moment after it.
“It’s a project with an end date.” The decision loop never stops running. Posture is a practice, not a milestone.
The part most Zero Trust conversations skip
Walk through the four properties again and notice that every example is a human. A user logs in. A user gets phished. A user travels.
Now count the identities in a modern environment. The humans are a rounding error. Services, workloads, CI runners, scheduled jobs, and increasingly AI agents all authenticate, hold credentials, and make requests. They are non-human identities, and there are far more of them than there are people.
Identity is the perimeter. Most of it isn’t human. The non-human identity layer is the larger, faster-growing, and less-watched part of that perimeter. A service account with a static key that nobody rotates is the new flat network. It is an implicit trust zone wearing a credential. The lateral movement story that justified Zero Trust in the first place plays out even more easily between machines, because nothing about a stale access key looks suspicious at 3 a.m.
That is the thread the rest of this series pulls on. Zero Trust for humans has the more mature tooling: phishing-resistant MFA, continuous evaluation, and policy-based access control are all things you can buy and deploy today, even if running the practice well is never finished. Zero Trust for machines does not have that tooling maturity yet. That is where the architecture work actually is.
Where this lives operationally
An architecture needs an operating practice. If the perimeter is identity, then defending it means watching the identity layer and managing its posture.
That is what the ITDR and ISPM categories are. Identity Threat Detection and Response watches for the abuse of valid identities, the token theft, the privilege escalation, the impossible session. Identity Security Posture Management finds the standing weaknesses before they get used, the dormant accounts, the over-scoped roles, the keys that never expire. Zero Trust is the architecture. ITDR and ISPM are how you run it once it is built.
Security note
The fastest real-world win from this model is phishing-resistant authentication for human identities. FIDO2 and passkeys remove the shared secret that most account-takeover chains depend on. But the durable win is structural: inventory and govern the non-human identities. A single un-rotated service-account key undermines a textbook Zero Trust deployment, because it reintroduces exactly the implicit, long-lived trust the model exists to eliminate. Treat machine credentials as short-lived and scoped by default, and treat any standing exception as a finding.
