Zero Trust
A security model where trust is never assumed based on network location and is continuously re-evaluated. Each access decision considers identity, device posture, and context. Codified in NIST SP 800-207. Distinct from ZTNA, which is the access control product category.
Zero trust is a set of design principles, not a product, and the identity parts are the ones that actually get implemented: strong authentication, device posture, per-application authorization, and continuous re-evaluation instead of a one-time gate at the perimeter. NIST SP 800-207 is the reference worth reading, mostly because it is vendor-neutral enough to argue with.
See also: what is zero trust, conditional access, ZTNA, microsegmentation, zero trust vendors
Related on Start with Identity
- GlossaryAdaptive Authentication
Authentication flows that change based on risk signals. Low-risk sign-ins may complete with one factor; high-risk sign-ins escalate to step-up MFA or are blocke
- GlossaryAuthentication Policy
An authentication policy is an identity provider rule that decides which authentication methods a user must satisfy to reach a given application, based on condi
- GlossaryDevice Posture
The state of a device at the time of access: OS patch level, disk encryption status, EDR presence, jailbreak detection, certificate enrollment. Posture is an in
- PodcastEntra.Chat
A weekly show for Microsoft Entra administrators, with deployment stories from practitioners and the engineers who build the product. Hosted by a Microsoft empl
- VendorCloudflare Zero Trust
top_tier
- ExpertSPIFFE and SPIRE maintainer, co-author of Zero Trust Networks
Evan Gilman is a maintainer of SPIRE, the reference implementation of SPIFFE, and co-wrote O'Reilly's Zero Trust Networks. He was an engineer at Scytale, where