What is zero trust security, for beginners?

Zero trust is a security model that never trusts a request just because it comes from inside the network. Every user, device and application has to prove who it is and get permission for each resource, every time, with the least access needed. NIST defines it in SP 800-207 (August 2020), and identity is its foundation.

What is the core principle of Zero Trust?

Never trust, always verify. Every access request is authenticated, authorized, and validated against policy and context such as device health and risk, and access is limited to what the task needs.

Is Zero Trust a product?

No. It is an architectural approach implemented with many tools across identity, device, network, and policy. Vendors sell components, most often zero trust network access (ZTNA), but no single product makes an organization zero trust.

Is ZTNA the same as zero trust?

No. ZTNA is the access layer of a zero trust program: it replaces network-level VPN access with identity-aware, per-application connections. Zero trust also needs strong authentication, device signals, least-privilege authorization and continuous evaluation, which ZTNA depends on but does not provide by itself.

Who are the main zero trust vendors?

For zero trust network access and SSE: Cloudflare, Zscaler, Netskope, Palo Alto Networks Prisma Access, Cato Networks, Check Point SASE (formerly Perimeter 81), Twingate, Tailscale and Appgate. Identity providers such as Okta and Microsoft Entra supply the identity and conditional access half. Most enterprise zero trust vendors are quote-only: in SWI's October 2026 pricing index, 77% of zero trust vendors did not publish a price.

Does zero trust replace the VPN?

Usually, over time. A VPN puts a device on the network and trusts it from then on; ZTNA connects a verified user to one application at a time. Legacy VPNs are a repeated breach path: Colonial Pipeline (2021) and Medibank (2022) were both entered through VPN logins without MFA.

Is there open source zero trust software?

Yes. OpenZiti, Pomerium, Teleport, Headscale, NetBird, HashiCorp Boundary and Authelia cover identity-aware proxies, overlay networks and infrastructure access. They remove licence cost but you run, patch and monitor them yourself.

What Is Zero Trust? Principles, ZTNA and Vendors

Zero trust is a security model in which no user, device, or network location is trusted by default: every access request is verified explicitly on identity, device posture, and context, and granted with the least privilege needed for that one resource. It replaces the old perimeter model, where anything inside the corporate network was trusted. Identity is its foundation, because once the network stops being the boundary, the login is.

Where the definition comes from

Three U.S. government documents shape how the term is used, and they are worth knowing because vendors quote them:

NIST SP 800-207 (August 2020) defines zero trust architecture: protection moves from static network boundaries to users, assets and resources, with a policy decision point that evaluates each request.
OMB M-22-09 (26 January 2022) ordered U.S. federal agencies to meet zero trust goals by the end of fiscal year 2024. It organizes them using CISA's model of five pillars (Identity, Devices, Networks, Applications and Workloads, and Data) and states that "for agency staff, contractors, and partners, phishing-resistant MFA is required."
NIST SP 1800-35 (final June 2025) documents 19 example zero trust implementations that NIST's NCCoE built with 24 collaborators, which makes it the most practical of the three.

The core principles

Verify explicitly: authenticate and authorize every request on signals like identity, device health, location, and risk.
Least privilege: grant the minimum access needed, ideally just in time (see what is PAM).
Assume breach: segment, monitor, and limit blast radius as if an attacker is already inside, using microsegmentation where networks still matter.

Why identity is the foundation

Once the network is no longer the perimeter, identity becomes the perimeter. That is why zero trust programs lean on strong authentication, phishing-resistant MFA, continuous authorization, and identity threat detection.

The breach record shows why the authentication step alone is not enough. In SWI's Identity Breach Report 2026, among the 41 breaches where the record states whether MFA protected the abused account, MFA was bypassed in 25 and absent in 16. Attackers who meet MFA mostly get around it, through relayed codes, approved pushes and stolen sessions, rather than stopping.

Zero trust vs VPN

Question	Traditional VPN	Zero trust access (ZTNA)
What the user reaches	A network segment	One application at a time
When trust is decided	At connection	On every request, with re-checks during the session
Device signal	Often none	Posture from MDM or EDR feeds the decision
Exposure to the internet	A listening gateway	Usually outbound-only connectors, no open inbound port
Lateral movement after compromise	Easy	Limited to what the user is entitled to
Typical failure	Legacy profiles, single-factor accounts, unpatched appliances	Policy exclusions, apps left on the old path

Zero trust network access and the 2026 vendor market

ZTNA is the access-layer implementation that replaces VPNs with identity-aware, per-application access. Vendors split into two architectures: cloud proxies that route traffic through their edge, and overlay or mesh networks that connect devices directly.

Need	Zero trust vendors to shortlist	Ownership and pricing notes (checked November 2026)
Large global SSE consolidation	Zscaler, Netskope, Palo Alto Prisma Access	All public companies; all quote-based by user and module
Value and developer-friendly SSE	Cloudflare	Public (NYSE: NET); free tier for small teams, per-user paid plans
SASE with SD-WAN	Cato Networks	Quote-based
Fast VPN replacement for a remote team	Twingate, Check Point SASE	Twingate free for 5 users, then $5 and $10 per user per month (read 2026-10-31); Check Point removed Perimeter 81's public prices
Developer and infrastructure mesh	Tailscale	Published per-user tiers with a free option
Traffic must stay on your infrastructure	Appgate	Private since a 2024 recapitalization; quote-based
Posture-gated infrastructure access	SonicWall Cloud Secure Edge	Formerly Banyan Security, acquired by SonicWall in 2023

Consolidation is still running: on 12 October 2026 IonQ announced an agreement to acquire Elisity, a microsegmentation vendor, and the deal was pending at the time of writing (see identity acquisitions). Expect a quote: in SWI's Identity Pricing Transparency Index 2026, 76.9% of zero trust vendors are quote-only and the category scores 23 out of 100 for price transparency.

For scored comparisons see the best zero trust tools ranking, the top zero trust network access tools, Cloudflare vs Zscaler, Zscaler vs Netskope and Tailscale vs Cloudflare. Teams that want to self-host can start from the open-source zero trust tools list.

What "implementing zero trust" actually means

In practice a zero trust program is four workstreams:

Strong authentication everywhere. Phishing-resistant MFA with a short exemption list that is reviewed, not inherited. Policies that require "MFA" generically are satisfied by methods that relay kits defeat daily. Passkeys rest on WebAuthn, which became a Level 3 W3C Recommendation on 25 August 2026.
Device signal in the access decision. Device posture from MDM or EDR, feeding conditional access. This is the workstream most often skipped because it requires enrolment on every endpoint.
Per-application authorization. ZTNA replacing flat network access, so a compromised endpoint reaches only what its user is entitled to.
Continuous evaluation. Re-checking during a session rather than only at the gate, because a session stolen after login satisfied every policy at issuance. The Shared Signals Framework, including CAEP, became Final OpenID specifications on 29 August 2025, so identity providers and access tools can now tell each other to revoke a session in a standard format.

Where zero trust fails in practice

The forgotten remote access path. Colonial Pipeline was entered through a legacy VPN profile with single-factor authentication, Medibank through a contractor's saved credentials on a VPN without MFA, and Change Healthcare through a Citrix portal without MFA. A zero trust program that covers the new path but leaves the old one open has not changed the risk.
The gateway itself. Remote access appliances are identity infrastructure. In 2026 a PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) gave ransomware operators VPN sessions without valid credentials.
Stolen sessions. Between July and September 2026 one actor replayed stolen Microsoft 365 tokens into 79 organizations, using adversary-in-the-middle phishing and token replay. Only continuous evaluation and device-bound sessions catch this.
Exclusions. Every deployment accumulates exemptions for a migration, a vendor, or a legacy app. Midnight Blizzard password-sprayed a legacy test tenant account with no MFA and reached Microsoft's corporate mail (password spraying). Audit the exclusion list more often than the policy list.

The honest limits

Device posture is self-reported by software on a machine an attacker may already control, so it is strong against commodity attacks and weak against a determined intruder holding the device. And the hardest part of most ZTNA migrations is not technology: it is producing an inventory of every internal application, who should reach it, and which ones depend on flat network access today.

Where to start

Enforce phishing-resistant MFA for administrators and remote access first, and shrink the exemption list.
Inventory every remote access path, including legacy VPN profiles and vendor support logins.
Move the highest-risk internal applications behind ZTNA, then retire the VPN route to them.
Add device posture and session revocation once the first apps are stable.

As a practitioner estimate, not a measured figure, steps 1 and 2 take a mid-sized organization weeks, while full VPN retirement takes quarters. Read the zero trust architecture guide and the zero trust rollout guide, and map your identity stack with what is IAM.