What Is Zero Trust — and Do You Actually Need It?
“Zero Trust” is one of those terms that got so thoroughly chewed up by marketing departments that it’s almost lost its meaning. Every vendor sells it. Half of them sell it as a product you can buy in a box. It is not a product you can buy in a box, and the sooner you internalise that, the harder it is to sell you the wrong thing.
I’ve sat through a lot of vendor pitches where “Zero Trust” was the headline and the substance underneath was a firewall with a new sticker. So let me do what those pitches usually don’t: explain what Zero Trust actually is, in plain English, and then tell you honestly whether you need to care about it.
The short version
Zero Trust is a security principle, not a technology. The principle is: never trust, always verify. Stop assuming that something is safe just because it’s already inside your network. Verify every access request — every user, every device, every time — regardless of where it’s coming from.
That’s it. Everything else is implementation detail. When a vendor tells you their appliance “is Zero Trust,” what they mean is their appliance helps you implement one slice of the principle. No single product delivers Zero Trust, the same way no single dumbbell delivers fitness.
The problem it actually solves
To understand why Zero Trust exists, you have to understand what it replaced: the perimeter model, sometimes called “castle and moat.”
The old model went like this: build a strong wall around your network — firewalls, a VPN to get in — and treat everything inside the wall as trusted. Once you were through the front door, the network largely assumed you belonged there. It worked reasonably well when “inside” meant an office building full of company-owned desktops.
That world is gone. Your people work from home, from cafés, from their phones. Your applications live in someone else’s cloud. Your contractors need access to some things but not others. The “inside” of the network is now everywhere and nowhere, and an attacker who gets through the front door — a phished password, a compromised laptop — inherits all that implicit trust and can move sideways through your systems almost unopposed.
Zero Trust is the response to that collapse. If you can’t define a trustworthy “inside” any more, then you stop granting trust based on location and start granting it based on continuous verification instead.
What Zero Trust actually means in practice
Strip away the marketing and Zero Trust comes down to a handful of concrete behaviours:
Verify explicitly. Every access decision is based on multiple signals — who the user is, whether they’ve proven it with strong multi-factor authentication, the health and identity of their device, where and when they’re connecting from — not just “they’re on the corporate network, let them through.”
Enforce least privilege. People and systems get access to exactly what they need to do their job, and nothing more. A marketing account has no business being able to reach the finance database. When that account is inevitably compromised, least privilege is what stops a bad day from becoming a catastrophic one.
Assume breach. Design as though an attacker is already inside — because at enterprise scale, at any given moment, one plausibly is. That mindset changes everything: you segment your network so a foothold in one area can’t reach another, you monitor continuously, and you make lateral movement hard rather than assuming it won’t happen.
Verify continuously, not just at the door. Trust isn’t granted once at login and then assumed for the rest of the session. Signals are re-checked. If a device’s security posture degrades mid-session, or behaviour suddenly looks anomalous, access can be challenged or revoked.
None of these is exotic. They’re disciplined versions of things good security teams already believed in. Zero Trust is less a revolution than a name for doing the sensible things consistently and by default, rather than as exceptions.
The vendor problem
Here’s where I’ll be blunt, because it’s the part the pitches skip.
“Zero Trust” has been turned into a sales category, and the category is incoherent. You’ll see it slapped on identity platforms, network appliances, endpoint tools, cloud gateways, and email security — products that do genuinely different jobs. Each is, at best, one component of a Zero Trust architecture. None of them is Zero Trust, and any vendor implying theirs is should raise your guard, not lower it.
A VPN is not Zero Trust — in fact it’s often the opposite. A traditional VPN drops you inside the perimeter and then trusts you. That’s the exact model Zero Trust exists to replace. The modern successor concept — Zero Trust Network Access, ZTNA — grants access to specific applications rather than the whole network, which is a real improvement, but it’s a component, not the destination. (If you’re weighing up VPNs for personal privacy, that’s a different problem entirely — I cover it in the best VPN for Australia guide. Don’t conflate consumer privacy VPNs with enterprise access architecture; they solve unrelated problems.)
The practical defence against vendor hype is the same one I recommend for any security purchase: make them explain, concretely, which part of the principle their product implements and how you’d measure whether it’s working. The habits I lay out in how to evaluate an EDR vendor transfer directly — the discipline of interrogating claims rather than absorbing them is the same regardless of the product category.
Do you actually need it?
This depends heavily on who you are, and the honest answers differ.
If you’re an individual or a household: you don’t “implement Zero Trust” — there’s no home version to buy, and anyone selling you one is selling you something else. But the spirit of it is worth adopting. Use strong, unique passwords in a manager so one breach doesn’t cascade. Turn on multi-factor authentication everywhere it’s offered. Don’t assume a device is safe just because it’s yours. That’s Zero Trust thinking scaled to a person, and it costs nothing but attention. A password manager plus MFA is genuinely most of the personal version.
If you’re a small business: you need the principles, not the enterprise stack. You cannot afford — and don’t need — a full Zero Trust architecture with microsegmentation and continuous device-posture assessment. What you can and should do: enforce MFA on everything, apply least privilege so staff only access what their role requires, and stop treating “on the office wifi” as a trust signal. Most of the value of Zero Trust for a small business is available through configuration and discipline, not a six-figure platform purchase.
If you’re an enterprise: yes, and you already know it’s a journey rather than a switch you flip. Zero Trust at scale is a multi-year programme touching identity, devices, networks, applications and data — sequenced by risk, not bought in one go. The failure mode I see most is treating it as a procurement exercise: buying “Zero Trust products” without first fixing identity, which is where the actual leverage is. Get strong identity and MFA right before you spend a cent on the fancier layers.
Where to actually start
For almost everyone, the answer is the same and it’s unglamorous: identity first.
Strong, phishing-resistant multi-factor authentication on every account that matters is the single highest-leverage move toward the Zero Trust principle, at every scale from a household to a government department. It’s the control that most directly kills the “stolen password gives an attacker the keys” problem — which is the problem the whole model exists to address.
If you’re an Australian organisation, this maps neatly onto guidance you may already be working toward. The ASD Essential Eight — particularly its emphasis on multi-factor authentication and restricting administrative privileges — is Zero Trust thinking in a prescriptive, measurable form. If you’re implementing the Essential Eight properly, you’re already walking a good distance down the Zero Trust road without needing the buzzword at all. That’s not a coincidence; they’re drawing from the same well of sound principles.
The practitioner’s take
Zero Trust is real, it’s important, and it’s the correct direction of travel for how modern security should work. It’s also one of the most oversold terms in the industry, and the gap between the principle and the products marketed under its name is wide enough to lose a budget in.
So hold both ideas at once. The principle — never trust, always verify, assume breach, least privilege — is genuinely worth organising your security around. The marketing — “buy our box and you’re Zero Trust” — is worth treating with the scepticism you’d apply to any claim that a single purchase solves a systemic problem.
Start with identity and MFA. Adopt the mindset before you shop for the tools. And when a vendor leads a pitch with “Zero Trust,” ask them exactly which part of the principle their product implements — then watch how quickly the conversation gets more honest.
