What is Zero Trust Architecture (ZTA)?

Why Zero Trust Architecture matters now

The shift to cloud services, Software as a Service (SaaS) applications, remote and hybrid work, and Internet of Things (IoT) has dissolved the network perimeter that traditional security was built around. Employees connect from anywhere, applications live in multiple clouds, and many devices reaching corporate resources are unmanaged. Meanwhile, attackers who compromise a single account or endpoint inside a perimeter-based network can exploit implicit trust to move laterally toward critical assets.

Zero trust architecture is the strategic response: it replaces blind trust in network location with dynamic, context-aware verification of every connection, segments access to limit the damage of any single compromise, and applies consistent security across on-premises, hybrid, and multicloud environments. Regulators have followed the same logic, from the 2021 US executive order requiring federal agencies to adopt ZTA to frameworks like the General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA), and Payment Card Industry Data Security Standard (PCI DSS) that reward its strict access controls.

Zero trust vs. zero trust architecture: What is the difference?

The two terms are often used interchangeably, but NIST SP 800-207, the reference publication on the topic, draws a useful line. Zero trust (ZT) is a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least-privilege, per-request access decisions on a network that is assumed to be compromised. Zero trust architecture (ZTA) is an enterprise's cybersecurity plan that applies those concepts, covering component relationships, workflow planning, and access policies. Zero trust is the philosophy, and zero trust architecture is how you implement it across your infrastructure, tooling, and policies. A zero trust enterprise is what you get once the plan is in place.

From castle-and-moat to zero trust

Legacy security followed a castle-and-moat model: hard to get in from outside, but everyone inside the walls was trusted by default and granted broad access.

The concept of zero trust emerged as a direct critique of that model, introduced in 2010 by Forrester analyst John Kindervag as a framework for protecting resources through rigorous access control rather than perimeter position. Digital transformation finished the argument: with data spread across clouds, a hybrid workforce, and Bring Your Own Device (BYOD) policies, the perimeter has effectively vaporized.

Zero trust shifts the question from where a user is connecting to who they are, what they need, whether their device is healthy, and whether their behavior looks risky. It also removes the attacker's favorite feature of the old model: once inside, there is no free lateral movement, because every internal connection is verified like an external one.

The core principles of zero trust

Never trust, always verify

No user, device, or workload is trusted by default, even if it is already connected to the corporate network. Every access request is treated as if it originated from an open network and must be explicitly authenticated and authorized using all available data points: identity, location, device health, and more.

Least privilege access

Users and devices receive the minimum level of access required to perform their specific task, and those permissions are revoked when the session ends. Limiting access rights reduces the blast radius of a compromised account and limits what an attacker can reach.

Assume breach

ZTA operates on the premise that a breach is not a possibility but an inevitability, and that attackers may already be inside. This mindset turns actions such as segmentation, continuous monitoring of every asset, and real-time response to anomalies into standard operating procedure rather than emergency measures.

Continuous monitoring and validation

Trust is never a one-time decision. Connections are continuously monitored and periodically reauthenticated during the session, with dynamic policies evaluating privileges, location, device posture, threat intelligence, and behavioral signals in real time.

Context-aware access policies

Access decisions are informed by context, not just credentials. A policy can deny access to sensitive financial data from a public Wi-Fi network even when the password and multi-factor authentication (MFA) check out, because the risk context changed.

Microsegmentation

The network is divided into small, isolated zones with their own access controls, so that a compromise in one segment cannot spread to the others. Unauthorized users cannot even discover resources they have no permission to access.

Key components of a Zero Trust Architecture

ZTA is not one tool but an integrated ecosystem. Most implementations combine the following building blocks, coordinated by policy.

The five pillars of zero trust (CISA)

The Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model, one of the reference frameworks alongside NIST SP 800-207 and Forrester's model, organizes a zero trust implementation around five pillars:

• Identity: Authenticate every user and grant access only to approved resources, using IAM, SSO, and MFA.
• Devices: Maintain a complete, current inventory of authorized endpoints, from laptops to IoT devices and printers, and deny everything unauthorized or non-compliant.
• Networks: Move from coarse segmentation to microsegmentation, encrypt traffic, and monitor user and entity behavior.
• Applications and workloads: Replace one-time, static access with dynamic authorization that requires continual revalidation, and monitor application-to-application and API traffic for unusual behavior.
• Data: Categorize data so targeted access controls apply, encrypt it in transit, in use, and at rest, and monitor processing for signs of breach or exfiltration.

How a Zero Trust Architecture works

Whatever the vendor stack, a zero trust access decision follows the same high-level flow.

First, verify identity: every request starts with authenticating the user or entity attempting access, typically through the identity provider with MFA. Second, determine the destination: the platform identifies the application or resource being requested and confirms it is legitimate. Third, assess risk: contextual signals such as user behavior, device posture, geolocation, and time of day are evaluated, increasingly with AI and machine learning, to compute the risk of the request. Fourth, enforce policy: access is granted, denied, or conditioned in real time, per session, and only to the specific resource, never to the network as a whole.

Users connect directly to applications rather than to a flat network, which is why unauthorized users cannot discover what they have no permission to see. In practice this requires an identity provider and an EDR solution as prerequisites, with connections continuously re-evaluated as context changes.

Zero Trust Architecture vs. VPN

The comparison comes up in nearly every ZTA project, because zero trust network access (ZTNA) is the technology most often deployed to replace remote-access Virtual Private Networks (VPNs). The difference is structural: a VPN connects a user to the network, while ZTNA connects a user to specific applications they are authorized to use, which is also why ZTNA is a core building block of Secure Access Service Edge (SASE) architectures.

Benefits of Zero Trust Architecture

• Improved visibility: Every user and device is approved every time, creating a clear record of who accessed what, why, and how.
• Reduced risk: Deny-by-default forces attackers to defeat verification at every step rather than once, significantly raising the cost of intrusion.
• Breach containment: Identity- and function-based segmentation shrinks the window between the first compromised machine and lateral movement, what threat hunters call breakout time.
• Protection against advanced persistent threats (APTs): Continuous verification breaks the quiet lateral movement that APTs rely on across flat networks.
• Support for distributed work: A borderless model applies the same controls regardless of location, covering remote work, BYOD, and cloud migration consistently.
• Better user experience than VPN: SSO and adaptive MFA reduce friction and MFA fatigue compared with legacy remote access.
• Easier regulatory compliance: ZTA aligns naturally with GDPR, HIPAA, and PCI DSS requirements for access control and monitoring.

Common use cases

• Secure remote access without VPN: ZTNA verifies employee identities and connects them only to the applications they need, scaling better than VPN and eliminating lateral movement paths.
• Multicloud and SaaS security: Access control based on identity rather than network location protects hybrid and multicloud environments consistently, and extends least privilege to SaaS apps like Microsoft 365 or Salesforce.
• Supply chain and third-party risk: Continuous, contextual authentication applies to vendors and contractors too, so a compromised supplier account cannot reach your most sensitive resources.
• Insider threat mitigation: Least privilege and behavioral monitoring limit what a malicious or negligent insider can access and flag unusual activity early.
• IoT visibility and control: Every IoT device is inventoried, tracked for location, status, and health, and treated as potentially hostile, with access controls and encrypted communications enforced.

How to implement a Zero Trust Architecture

Zero trust cannot be bought as a single product; it is implemented in phases. A pragmatic sequence, aligned with NIST SP 800-207 and field practice, looks like this:

1. Assess the organization: Define the attack surface and identify the sensitive Data, Assets, Applications, and Services (DAAS) to protect. Audit every credential, human and service account alike, review privileges, and give the crown jewels the highest level of protection.
2. Inventory assets and map transaction flows: Determine where sensitive information lives, who accesses it, and how DAAS components interact. Remove deprecated authentication protocols such as NT LAN Manager (NTLM), list sanctioned cloud services, purge stale accounts, and enforce password rotation.
3. Establish preventative measures: Deploy MFA everywhere, triggered adaptively by risk and behavior; enforce least privilege with continuous verification; and segment identities with micro-perimeters that act as internal border controls.
4. Monitor the network continuously: Inspect, analyze, and log all traffic without interruption, escalate anomalous authentications, and prepare clear response plans for service-account anomalies and other critical resources.
5. Roll out incrementally: Start with the most critical assets and a pilot population, and expect the program to mature over quarters rather than weeks.

Challenges and limitations

88% of Chief Information Security Officers (CISOs) report significant challenges implementing zero trust. There is no single universal implementation standard, so organizations must translate frameworks like NIST SP 800-207 and the CISA maturity model into their own environment. Legacy systems and deprecated protocols resist per-request authentication.

Mapping data flows and maintaining accurate asset and identity inventories takes sustained effort, and overly aggressive policies can frustrate users if deployed without tuning. Most importantly, zero trust reduces the probability and blast radius of compromise, but its own assume breach tenet concedes that prevention will sometimes fail. A ZTA that is not paired with strong detection and response capabilities leaves the last line of that architecture unmanned.

Expert insight: assume breach means detect and respond

The assume breach principle is an admission that identity checks, device posture, and microsegmentation will occasionally be beaten: by stolen sessions, by a compromised identity provider account, by a trusted insider, by a supply chain attack that arrives with valid credentials. When that happens, the value of your zero trust architecture depends entirely on how fast you notice and how fast you act. Zero trust generates exactly the telemetry needed for that job: identity provider logs, ZTNA and proxy access decisions, EDR signals, and segmentation violations are among the richest detection sources a Security Operations Center (SOC) can get.

That is where Sekoia fits in a zero trust strategy. The Sekoia AI SOC platform ingests this telemetry through more than 300 integrations, from identity providers to zero trust proxies; the Zscaler ZIA integration is a concrete example, correlating access logs with Sigma rules, detecting anomalies with machine learning, and automatically retro-hunting each new Indicator of Compromise (IoC) across past events.

Sekoia Defend applies roughly 1,000 detection rules mapped to MITRE ATT&CK, including the credential access, privilege escalation, and lateral movement techniques that a zero trust breach attempt produces, enriched with native Cyber Threat Intelligence (CTI) from Sekoia Intelligence and the in-house Threat Detection & Research (TDR) team.

For the European organizations that often adopt zero trust with GDPR and sovereignty requirements in mind, Sekoia brings something US platforms rarely lead with: a European vendor with a genuine data sovereignty posture. Combined with automated incident response, a suspicious session can be investigated and contained in minutes. Build the zero trust architecture to prevent, and put detection and response behind it, because that is what assume breach actually asks of you.

‍

Frequently asked questions