What is zero trust security?
Short answer
Zero trust is a security approach that does not grant access based on network location. Every request is verified using identity, device health and context, and users get only the access they need. It replaces the idea that anything inside the office network can be trusted.
The details
For small organizations, practical zero trust steps include MFA everywhere, single sign-on, device management, least privilege and removing broad VPN access in favor of per-application access.
Terms explained
- Least privilege
- Least privilege means giving each user, service or AI agent only the access it needs to do its job, and no more, for only as long as it needs it.
- Zero trust
- Zero trust is a security model that grants access per request based on verified identity, device health and context, rather than trusting anything inside a network perimeter.
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
- VPN
- A VPN (virtual private network) creates an encrypted tunnel between your device and a VPN server, hiding your traffic from the local network and internet provider.
Sources
Related questions
Related Guides
GuideSOC
9 Quick-Win AI Agent Use Cases for Security Operations
Nine high-impact, low-effort SOC tasks to hand to AI agents first, what each agent does and the metric that proves it, plus the tasks to keep human.
Read more GuideWeb Security
How to Protect Your Projects From Malicious npm Packages (and What GitHub's New Package Firewall Does)
GitHub launched a package firewall that blocks risky npm packages before they install. Learn how it works, who can use it and 10 steps any team can take today.
Read more GuideSOC
How to Build an Agentic SOC: A 4-Phase Roadmap for AI Security Operations
A practical roadmap for moving a SOC to AI agents: build the data foundation, start with quick wins, customize and orchestrate agents, and keep humans in command.
Read more GuideSOC
6 SOC Functions to Automate With AI Agents (and What to Keep Human)
Which SOC tasks should AI agents handle and which need a human? A function-by-function guide to automation potential, the AI role, the human role and the outcome.
Read more