Zero Trust is a security approach that stops granting automatic trust to any access request just because it comes from inside the company network: each request is verified using the person's identity, the state of the device and other signals, and authorised only for the specific resource it needs. It is a way of designing access, not a product.
How it works
The traditional model resembles a castle with a moat: whoever crosses the perimeter (for example, with a VPN) can usually move freely inside. Zero Trust assumes the network can be hostile, including your own, and requires every access to be checked against a policy: who the person is, from which device, in what state and what they are trying to open. NIST defines it as an evolving set of paradigms that move the focus of defences from static, network-based perimeters to users, assets and resources.
The NCSC, the UK's cyber security agency, summarises its foundations in principles such as knowing your architecture and identities, assessing user behaviour and device health, deciding with policies, authenticating and authorising everywhere, monitoring users, devices and services, and not trusting any network.
Example
Illustrative example, not a real case. A company with remote staff gives VPN access to the whole internal network. It decides to start with the most sensitive items: the accounting application and the administration consoles. From now on they open only if the person signs in with a second factor and their device is managed and up to date; other resources are migrated later.
Before switching it on, the company tests what happens when a signal fails, for example if a device stops reporting its state. The rule is to deny or give limited access, never to approve silently.
Limits
The NCSC stresses that Zero Trust is not a product, not a quick fix, does not mean trusting no one, does not require abandoning the VPN and is never finished: it is a strategic commitment adopted deliberately that may take several years. It also means more security controls, not fewer, and can be costly and disruptive: first consider whether more targeted controls would deliver similar benefits. A tool carrying the Zero Trust label does not prove that real access follows these principles.
Decisions depend on signals whose quality needs watching, and old systems call for intermediate solutions. For a small company, the first useful steps tend to coincide with the basic controls: a second factor, least privilege, protected and updated devices, and an inventory of applications and access.
When to call an expert
It is worth asking for help when you have remote or hybrid work, cloud applications alongside old systems, access for outside suppliers, a VPN that opens the whole network or when a customer or an audit asks you to justify how access is controlled. A preliminary assessment helps prioritise which resources are most critical and which changes are worth the effort.
At Impulso Tecnológico we work on diagnosis, technical controls and training: we review identities, access and devices and implement the technical controls that fit. See our cybersecurity service, the guide to building an IT security plan or tell us about your case.
Learn more
Related glossary terms: MFA, VPN, endpoint and NAC.
Official sources: the NIST publication SP 800-207, Zero Trust Architecture and the NCSC guidance Demystifying Zero Trust and Zero trust architecture design principles, written for large organisations.