In short
Zero trust security is an approach in which no user, device or network is trusted by default. Every request to an application or data is checked against identity, device health and an access policy before it is allowed. For most UK businesses it starts with MFA, managed devices and ZTNA in place of the VPN.
Want help with What is zero trust??
We can plan it with you or do it for you. Tell us where you are up to.
What zero trust means
The NCSC's Introduction to Zero Trust (opens in a new tab) describes a zero trust architecture as an approach to system design where inherent trust in the network is removed. The network is assumed hostile and each access request is verified, based on an access policy. Confidence in a request comes from building context: strong authentication, authorisation, device health and the value of the data being accessed.
The US standard, NIST SP 800-207 (opens in a new tab), says the same thing from a different angle: zero trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location, or on whether the device is owned by the business. Authentication and authorisation, of both the user and the device, happen before a session to a resource is set up.
In practice, the zero trust meaning most people quote is never trust, always verify. "Zero" does not mean no trust at all. The NCSC's Demystifying Zero Trust (opens in a new tab) points out that plenty of trust is still needed; the point is that it is earned for each request, from signals, rather than assumed because someone is inside the network.
Zero trust vs the old perimeter model
The model zero trust replaces is often called "castle and moat". The firewall and VPN are the moat; once you are across it, most of the network is open to you. The NCSC contrasts this with an airport, where you prove who you are at several points and can only board the aircraft you have a ticket for.
| Question | Perimeter (castle and moat) | Zero trust model |
|---|---|---|
| Where is trust decided? | Once, at the edge: the firewall or VPN login | At every request, close to the application or data |
| What does being on the network give you? | Broad access to internal systems | Nothing on its own; each application is authorised separately |
| Which signals count? | Mainly network location and a password | User identity, MFA strength, device health, behaviour and the sensitivity of the data |
| What happens after a stolen login? | The attacker can often move sideways across the network | The attacker reaches only what that account and device are allowed, and unusual behaviour can be blocked |
| Remote and office staff | Remote staff tunnel in; office staff are trusted by location | The same policy applies wherever people work |
| Typical tools | Edge firewall, remote access VPN, flat internal network | Identity provider with MFA, device management, ZTNA, segmentation, central logging |
Read the table as a flow diagram from left to right: in the perimeter model a request passes one checkpoint and then reaches everything behind it; in a zero trust model every request goes through a policy decision before it reaches the one resource it asked for. NIST makes the same point: the aim is to make the "implicit trust zone" behind each checkpoint as small as possible.
Not sure which option applies to you? Ask us
Tell us about your organisation and we will point you to the right option.
The zero trust model in four parts
Strip away the vendor language and every zero trust security model has the same four parts. NIST SP 800-207 and the NCSC use slightly different words for them, but they line up:
| Part | What it does | NCSC / NIST term | Typical technology |
|---|---|---|---|
| 1. Identity | Proves who (or which service) is asking | User, service and device identity | Identity provider, single sign-on, MFA |
| 2. Device | Shows whether the device is known and healthy | Device health; asset state | Device management, endpoint protection, device trust checks |
| 3. Policy decision | Weighs the signals against the access policy and says yes or no | Policy engine; policy decision point | Conditional access, ZTNA policy engine |
| 4. Protected resource | The application or data, reachable only through an enforcement point | Policy enforcement point; resource | ZTNA connector or gateway, application proxy, segmentation |
The detail of how those parts connect is on zero trust architecture. The ideas behind them, such as least privilege and assume breach, are on zero trust principles.
Who invented zero trust?
The ideas are older than the name. NIST SP 800-207 (section 1.1) traces them through the US Defense Information Systems Agency's "black core" work and the Jericho Forum, which publicised "de-perimeterisation" in 2004. NIST credits John Kindervag, while he was an analyst at Forrester, with coining the term zero trust. Forrester's own report page, No More Chewy Centers: The Zero Trust Model Of Information Security (opens in a new tab), says Forrester developed the Zero Trust Model in 2009.
| Milestone | What happened | Source |
|---|---|---|
| 2004 | The Jericho Forum publicises de-perimeterisation: limiting implicit trust based on network location | NIST SP 800-207 (opens in a new tab), section 1.1 |
| 2009 | Forrester develops the Zero Trust Model, in work by John Kindervag | Forrester (opens in a new tab) |
| 2020 (August) | NIST publishes SP 800-207 Zero Trust Architecture, with tenets, logical components and deployment models | NIST SP 800-207 (opens in a new tab) |
| 2021 (July) | The NCSC publishes its zero trust architecture design principles | NCSC (opens in a new tab) |
| 2026 (May) | The NCSC publishes its ZTNA guidance | NCSC ZTNA guidance |
For a UK organisation, the NCSC guidance is the reference to design against; we compare it with NIST and CISA on zero trust frameworks.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
What zero trust looks like in a business
Zero trust cyber security is not one purchase. For a typical UK business of 20 to 2,000 people, it shows up as a handful of changes that each remove a piece of assumed trust:
- MFA on every account, with phishing-resistant methods for administrators, so a stolen password alone gets an attacker nowhere.
- Device checks at sign-in: only managed, patched, encrypted devices reach sensitive systems; personal devices get a narrower, browser-only route.
- ZTNA instead of a remote access VPN: people reach the specific applications they need, not the whole network. See what is ZTNA? and ZTNA vs VPN.
- Segmentation so that one infected laptop or server cannot reach everything else. See zero trust networking.
- Monitoring of users, devices and services, with identity, endpoint and access logs in one place.
None of these needs a "big bang". The NCSC notes that a full migration can take several years and that existing controls should stay until their replacements are mature.
Where to start
Most businesses get the quickest, most visible result from ZTNA, because it replaces the VPN that every remote worker uses and forces the identity and device work that zero trust depends on. A sensible order:
- Run a short zero trust assessment: which applications exist, who needs them, and how people reach them today.
- Fix identity: one identity provider, MFA everywhere and a reliable leaver process.
- Bring devices under management so device health can be part of each access decision.
- Move the first group of users and applications to ZTNA, following how to implement zero trust.
- Extend to the rest, then segment what remains on the internal network.
Zero trust products we supply
Zero trust is an approach, but you still need products to put it into practice. Forever Systems, a Cisco Partner and Check Point Advanced Partner, supplies several ZTNA platforms, including Cisco Secure Access, Check Point SASE Private Access (opens in a new tab), Island, Zero Networks and others suited to smaller businesses, plus Cisco Duo (opens in a new tab) for MFA and device trust. They are mapped pillar by pillar on zero trust solutions. Because we supply more than one, we can recommend the one that fits your applications, devices and team, and quote for it. Licensing is usually per user, per month or per year, confirmed at quote.
Some platforms bundle ZTNA with web security and SD-WAN as SASE (opens in a new tab); that is covered on our sister site.
Contact us for free advice on where zero trust would make the biggest difference in your business.
Zero trust security in more depth
How Forever Systems helps with ZTNA
Forever Systems supplies and supports several zero trust network access platforms, so we can recommend what fits how your people work and the tools you already run.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across the ZTNA products we supply, including Cisco Secure Access (opens in a new tab) and Check Point Private Access
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
Is zero trust a product?
No. The NCSC says to think of zero trust as an architectural approach, not a product you can buy off the shelf. Products such as ZTNA platforms, MFA and device management support it; your access policies, identity set-up and the removal of old access routes are what make it work.
Is ZTNA the same as zero trust?
No. Zero trust is the overall approach to security design. ZTNA (zero trust network access) is one part of it: the technology that controls how users and devices reach applications, replacing broad network access through a VPN with per-application access. See what is ZTNA?
Who invented zero trust?
NIST SP 800-207 credits John Kindervag, while he was an analyst at Forrester, with coining the term. Forrester says it developed the Zero Trust Model in 2009. The idea built on earlier work such as the Jericho Forum's de-perimeterisation, publicised in 2004.
Does zero trust replace a firewall?
Not usually. Firewalls still have jobs in a zero trust design, such as separating network segments and protecting internet-facing services. What changes is that the firewall at the edge stops being the main thing that decides who can reach internal applications. See zero trust networking.
Is zero trust only for large companies?
No. NCSC guidance is written mainly for security professionals, large organisations and the public sector, but the core steps (MFA, managed devices, per-application access instead of a VPN) suit small businesses too, and several ZTNA products are designed for small teams. See ZTNA for small businesses.
What does zero trust mean in simple terms?
It means nobody and no device is trusted just because they are connected to your network. Each time someone opens an application, the system checks who they are, whether their device is healthy and whether policy allows that request, then grants access to that application only.
Still have a question about What is zero trust??
Ask us and a member of our team will get back to you.