.png)
What is Zero Trust Security?
Zero Trust is a security model that eliminates implicit trust inside your network. Learn what it means, why it matters to boards and PE, and how to implement it.
What Zero Trust Actually Means
The term Zero Trust originated in a 2010 Forrester Research report by John Kindervag, then a principal analyst. The core principle is simple: never trust, always verify. Traditional network security operates on an implicit trust model — once inside the network perimeter (via VPN, physical presence, or a whitelisted IP address), a user or device is treated as trustworthy. Zero Trust rejects this model entirely.
In a Zero Trust architecture, every access request is evaluated against four criteria: who is requesting access (identity), what device they are using (device health), what resource they are trying to access (resource sensitivity), and what the surrounding context suggests about the request (location, time, behavior pattern). Access is granted only when all four factors pass evaluation — and only for the specific resource requested, not for broad network segments.
The phrase 'assume breach' captures the operational posture. A Zero Trust architecture is designed as if attackers are already inside the network. Because in most real-world breaches, they are — for an average of 194 days before detection, according to IBM's Cost of a Data Breach Report.
Why Traditional Perimeter Security Fails
Perimeter security was designed for a world where all organizational resources lived inside a physical location and all employees worked from corporate offices on corporate devices. That world no longer exists. Cloud infrastructure, remote work, SaaS applications, third-party integrations, and mobile devices have dissolved the perimeter. There is no inside and outside — there is just access.
The consequence is that breaching the perimeter — through phishing, credential stuffing, stolen VPN credentials, or a compromised partner — gives an attacker implicit access to everything the perimeter was protecting. Lateral movement from an initial access point to high-value targets is trivially easy in a flat, perimeter-trusted network. The Colonial Pipeline attack, the SolarWinds breach, and the MGM Resorts compromise all followed the same pattern: perimeter breach, lateral movement, high-value target access.
The Five Core Principles of Zero Trust
Zero Trust implementations vary significantly in scope and maturity, but all share five foundational principles.
Verify explicitly. Every access request is authenticated and authorized based on all available data — identity, location, device health, service or workload, data classification, and anomalies. Not once at login. Continuously.
Use least-privilege access. Users, devices, and workloads receive only the minimum access necessary to perform their function. Just-in-time and just-enough-access provisioning limits the blast radius of any compromise. A compromised account with least-privilege access can reach only what that account was permitted to reach — not everything on the network.
Assume breach. Design systems to limit blast radius, segment access, encrypt end-to-end, and use analytics to detect anomalies. The assumption that an attacker is already present drives architectural decisions that reduce the cost of any individual compromise.
Microsegmentation. Divide networks into small zones with granular access controls rather than flat network segments with broad implicit trust. An attacker who compromises one microsegment cannot automatically access adjacent segments.
Continuous monitoring and validation. Access decisions are not made once — they are continuously re-evaluated. Behavioral anomalies — a user accessing resources at 3 AM from an unusual location, a device whose security posture has degraded — trigger re-verification or access revocation.
Zero Trust in Practice: What Implementation Actually Looks Like
Zero Trust is an architecture, not a product. No vendor sells a 'Zero Trust solution' that replaces the architecture decision — despite what many marketing decks claim. Implementation is a multi-year journey across identity, device management, network segmentation, data classification, and application access.
The typical maturity path follows four stages. Traditional perimeter-centric security is the starting point for most organizations. Identity-centric access — where Multi-Factor Authentication and conditional access policies are applied to all applications — is the first meaningful Zero Trust milestone. Device health verification — where access is conditioned on device compliance status checked in real time — is the second. Microsegmentation and workload protection — where lateral movement is structurally prevented — is the mature state.
Microsoft, Google, and the US federal government (via CISA's Zero Trust Maturity Model) have all produced implementation frameworks that provide structured paths through this maturity journey. NIST SP 800-207 is the authoritative technical reference for federal and regulated industry implementations.
What Boards and PE Operating Partners Need to Know
For boards, the most important question is not 'do we have Zero Trust?' — because the answer is always somewhere on a spectrum. The meaningful questions are: Has the organization eliminated implicit trust for privileged accounts and high-value systems? Is MFA universally deployed across all remote access and cloud applications? Does the organization have microsegmentation that limits the blast radius of a perimeter breach?
For PE due diligence, Zero Trust maturity is a leading indicator of overall security program sophistication. Organizations that have not implemented basic identity-centric controls — MFA, conditional access, privileged access management — have not started the Zero Trust journey. A portfolio company that is on VPN-centric flat network architecture with legacy perimeter controls is structurally exposed to the lateral movement pattern that characterizes the most costly enterprise breaches.
The investment thesis matters. A Zero Trust transformation at a 500-person company takes 18-36 months and requires sustained leadership attention and capital. Organizations that have not started by the time PE due diligence occurs will require post-close investment. Identifying this early prevents surprises at the 100-day mark.
Common Misconceptions About Zero Trust
Zero Trust is not a product you can purchase. No single technology delivers Zero Trust. Identity providers, endpoint management platforms, network segmentation tools, and SASE architectures are all components of a Zero Trust implementation — but the architecture is the decision, not any individual product.
Zero Trust does not mean Zero Productivity. A common objection is that requiring continuous verification creates friction for legitimate users. Well-implemented Zero Trust is designed to be frictionless for normal access patterns and friction-generating only for anomalous ones. A user accessing their normal applications from their registered device in their normal location experiences no additional verification steps. The same user accessing sensitive financial systems at 2 AM from an unregistered device in an unusual country triggers step-up authentication.
Zero Trust is not a one-time project. It is an operating model. Organizations that implement Zero Trust controls and then consider the work done will find their architecture degrading as the threat landscape evolves. Zero Trust requires continuous policy refinement, monitoring, and response.
Related Reading
Colonial Pipeline: The Cost of a Flat, Perimeter-Trusted Network
The 2021 Colonial Pipeline ransomware attack — which shut down fuel delivery to the US East Coast and cost the company $4.4M in ransom — was enabled in part by a flat network architecture that gave attackers who compromised a single VPN credential lateral access to operational technology systems. The VPN account used to breach the network had not been active for months and was not protected by MFA. There was no microsegmentation preventing movement from IT to OT networks. One compromised credential. One flat network. Seventeen days of disruption and $4.4M in ransom. A Zero Trust architecture with MFA on all remote access and microsegmentation between IT and OT networks would have structurally prevented the lateral movement pattern the attackers exploited.
of breaches involved assets in the cloud, remote access, or partner networks — environments where traditional perimeter security provides no meaningful protection. Zero Trust is the architectural response to a world where the perimeter no longer exists.