Zero trust security is an approach where no user, device or network location is trusted by default. Every request for access is checked against a policy each time, whether it comes from outside your business or from a laptop on your own office network. The UK’s National Cyber Security Centre (NCSC) describes it as an architectural approach where inherent trust in the network is removed.
That is the short answer. The rest of this guide covers what it means in practice, what it does not mean, and how to tell whether your own setup would stand up to it.
Table of Contents
What does zero trust security mean in plain English?
Older security designs worked like a castle. You built a strong wall (the firewall), and anything inside the wall was treated as friendly. Once an attacker got in, usually through a stolen password or a phished employee, they could often move around freely.
Zero trust security drops the idea of a friendly inside. The NCSC’s guidance says the network should be assumed hostile, and that each request is verified against an access policy. So a connection from your head office gets the same scrutiny as one from a hotel Wi-Fi network.
The phrase “never trust, always verify” is a handy summary. It is a design idea, though, and not a product you can buy in a box.
Is zero trust a product or a strategy?
Zero trust security is a strategy. Vendors sell tools with “zero trust” on the label, but no single tool delivers it. NIST’s Special Publication 800-207, published in August 2020, defines zero trust architecture as a set of principles that move defences away from fixed network perimeters and towards users, assets and resources.
The same document states that access is not granted just because of where a device sits on the network, or because the device is company-owned. Authentication and authorisation of both the user and the device happen before a session to a resource starts.
What are the core principles of zero trust security?
The NCSC lists a set of design principles. These are the ones that matter most for a small or mid-sized organisation:
- Know your architecture. List your users, devices, services and data. You cannot protect what you have not mapped.
- Know your identities. Every user, service and device needs an identity you can verify.
- Assess health and behaviour. A valid login from an unpatched or unusual device should not get the same access as one from a healthy device.
- Use policies to authorise requests. Access decisions come from written rules, not from network location.
- Authenticate and authorise everywhere. Checks apply to every request, not just the first login of the day.
- Focus monitoring on users, devices and services. You watch who is doing what, instead of only watching the network edge.
- Do not trust any network, including your own.
The NCSC also warns about late-stage pitfalls when you try to fit legacy services that cannot support zero trust into the design. Plan for those early.
How does zero trust differ from the traditional perimeter model?
| Question | Perimeter model | Zero trust |
|---|---|---|
| Where does trust come from? | Being on the internal network | Verified identity, device health and policy |
| What happens after login? | Broad access to many systems | Access to one resource at a time, rechecked |
| What if an attacker gets in? | They can often move sideways | Each hop needs fresh authorisation |
| What is watched? | Traffic at the edge | Users, devices and services |
The practical gain is containment. If one account is stolen, the damage is limited to what that account was allowed to reach, not the whole network.
What does zero trust look like for a small business?
You do not need to rebuild everything. Most organisations start zero trust security with a few changes that deliver the biggest drop in risk:
- Turn on strong multi-factor authentication for email, remote access and admin accounts. It is not perfect, and our guide on what multi-factor authentication stops and what still gets through explains the gaps.
- Cut standing admin rights. Give people the access their job needs and no more.
- Check device health before granting access to company data. Unmanaged or out-of-date devices get less.
- Split up the network. A printer, a guest phone and a finance server should not share one flat network.
- Log and review access. Alerts on odd sign-ins are worth more than a quiet dashboard nobody reads.
CISA’s Zero Trust Maturity Model frames this as a journey. It describes four stages within each area, from traditional through initial and advanced to optimal, and notes that adopting zero trust may need a change in organisational culture as well as new technology. That matches what we see: most firms sit somewhere in the middle and improve a step at a time.
Why does zero trust matter for UK organisations?
Stolen credentials and phished staff are still the usual way into a network. Zero trust assumes that will happen and limits what an intruder can do next. That fits how a lot of real intrusions unfold: an attacker lands on one machine, then uses weak internal trust to reach something valuable.
Zero trust security also suits how people actually work. Staff use cloud services, personal phones and home broadband, so a single trusted office network no longer describes where your data lives. If you run cloud workloads, the same thinking applies to how identities and roles are set up, which is something we check in cloud penetration testing.
How do you test whether zero trust actually works?
A design on paper proves little. The real question is whether zero trust security holds up, meaning whether an attacker with one foothold can still move around. Testing it means trying exactly that.
An internal network penetration test starts from the position of a compromised user or device and looks for the weak points that zero trust is meant to remove: flat networks, shared credentials, over-privileged accounts and services that trust each other too easily. Testers will often try to chain a small mistake into privilege escalation to see how far one account can reach.
If you are still working out where your attackers would aim first, threat modelling is a good planning step before any build or test. When you want an independent view of how well your controls hold, Aardwolf Security can scope a penetration test around your real environment, and you can reach the team through the contact page.
Frequently asked questions
Is zero trust the same as having no trust in your staff?
No. It is about not letting network location or a single past login stand in for proof. Honest staff on healthy devices should barely notice it, because verification happens in the background.
Does zero trust security replace a firewall?
No. Firewalls still filter traffic and still matter. Zero trust adds identity, device and policy checks on top, so a firewall is no longer the only thing between an attacker and your data.
Can I adopt zero trust all at once?
Rarely. Legacy systems, old applications and tight budgets make a gradual rollout more realistic. Start with identity and your most sensitive data, then widen from there.
Does zero trust stop ransomware?
Zero trust security does not stop the first infection, but it can limit how far ransomware spreads. Tight access and a segmented network mean fewer systems fall to a single compromised account.
How do I know if I need it?
If staff work remotely, use cloud services or hold sensitive data, then the “trusted inside” assumption already fails for you. A test of your internal network will show how much that assumption is costing you.
Subscribe to our newsletter
Honest updates, straight to your inbox. Unsubscribe any time.
