What is Zero Trust Networking?
Updated: 3 days ago
Zero Trust Networking is a security approach that removes inherent trust from the network. A user, device or service is not trusted simply because it is inside an office, connected to a corporate VPN or using an approved IP address. Each request for data or a service is authenticated and authorised against policy using signals such as identity, device health, location, behaviour and the sensitivity of the resource.
The most important distinction is that Zero Trust is not a product and it does not literally mean that nobody is ever trusted. It is an architectural model for deciding whether a specific request has enough verified context to be allowed, usually with the minimum access needed.
How does Zero Trust Networking work?
Traditional perimeter security often treats the internal network as more trustworthy than the internet. Once a user or device passes the perimeter, it may be able to reach several internal systems. Zero Trust challenges that assumption. The network is treated as potentially hostile, including the local network, so access decisions are based on identity and policy rather than location alone.
A simplified Zero Trust request can be thought of as a sequence: identify the requester, authenticate the relevant identities, assess the device and context, authorise the requested resource against policy, enforce the decision, then continue monitoring the signals that informed it.
This does not mean every packet triggers a human-style login prompt. Modern systems can reuse authenticated sessions, device certificates, short-lived tokens and continuously evaluated signals. The point is that access is not granted indefinitely merely because a connection originated from a trusted subnet.
The infographic below shows the core change from network-based trust to request-based verification.
The core principles behind Zero Trust
The UK's National Cyber Security Centre describes Zero Trust as an architectural approach where inherent trust in the network is removed, the network is assumed hostile and each request is verified against access policy. Its current guidance emphasises identity, device and service health, policy-driven authorisation, authentication everywhere, monitoring and secure transport.
Know what you are protecting: users, devices, services, applications and data need to be understood before useful policy can be written.
Use strong identities: users, devices and software services should have identities that can be evaluated rather than relying on network location.
Assess health and context: device posture, user behaviour, location and other signals can increase or reduce confidence in a request.
Authorise against policy: access is granted because the request satisfies policy, not because it arrived from an internal address.
Use least privilege: provide only the access required for the task or service.
Continue evaluating: a decision can change when the user, device or risk context changes.
Treat networks as untrusted: protect communications with authenticated, encrypted protocols rather than assuming a private LAN is safe.
Zero Trust vs traditional perimeter security
A perimeter model is often described as a castle-and-moat design. Strong controls protect the edge, while systems inside the perimeter may have broader reachability. That model becomes harder to defend when staff work remotely, applications run across multiple clouds, SaaS services sit outside the corporate network and partners need selective access.
Zero Trust moves the decision closer to the resource. Being on the office LAN can still be a useful signal, but it should not automatically grant broad access. A request from an office desktop and a request from a home laptop can both be evaluated using identity, device posture and policy.
This complements network segmentation. Segmentation limits which parts of a network can communicate. Zero Trust adds identity, context and policy to the decision about whether access should be allowed. The two approaches can reinforce each other.
Zero Trust vs ZTNA
Zero Trust and Zero Trust Network Access are related but not identical. Zero Trust is the wider security architecture and operating philosophy. ZTNA is an access approach used to connect users and devices to specific applications or resources according to Zero Trust principles.
A ZTNA service can replace some traditional remote-access VPN use cases by exposing authorised applications rather than placing the remote device broadly onto the private network. That does not make every VPN obsolete, and the NCSC explicitly notes that Zero Trust and VPNs are not mutually exclusive.
For the networking distinction, see What is VPN (Virtual Private Network)?. A VPN creates an encrypted tunnel to a VPN endpoint. Zero Trust determines whether a particular identity and device should be allowed to reach a particular resource.
Identity is central, but identity alone is not enough
A username and password can establish part of an identity claim, but Zero Trust access decisions are normally stronger when several signals are combined. The NCSC states that multi-factor authentication is a requirement for a Zero Trust architecture and highlights passwordless approaches such as FIDO2 as a strong option.
User identity: who is making the request?
Device identity: which managed or unmanaged device is being used?
Device health: is the operating system supported, patched and compliant with policy?
Service identity: which application, workload or software process is communicating?
Location and network context: is the request coming from an expected environment?
Behaviour: is the timing or activity unusual for this identity?
Resource sensitivity: is the requested data low risk or highly sensitive?
What is a policy engine?
A policy engine is the decision-making component that evaluates the signals available for a request against defined access rules. A simple rule might require a known employee identity, MFA, a managed device with current security controls and permission for the requested application.
Real systems can be more dynamic. If device health changes, a token becomes less trustworthy or behaviour becomes unusual, the policy decision can require re-authentication, restrict access or terminate the session. The NCSC specifically recommends continuous evaluation so confidence can change during a connection rather than only at login.
Least privilege and lateral movement
Least privilege means granting only the permissions needed for a user or service to perform its role. It reduces the value of a compromised account because that identity should not automatically gain access to unrelated systems.
This matters for lateral movement. In a flat or overly trusted internal network, an attacker who compromises one endpoint may discover and reach other services. Zero Trust aims to reduce that opportunity by requiring access to be explicitly authorised. It does not eliminate lateral movement as a threat, but it can reduce the routes available to an attacker and improve the visibility of attempted access.
A VLAN can separate broadcast domains and support segmentation, but a VLAN is not a Zero Trust policy system. Network boundaries and identity-aware access controls solve different parts of the problem.
Does Zero Trust mean the network no longer matters?
No. Treating a network as untrusted does not mean ignoring network security. The NCSC still recommends good cyber hygiene on local networks, including monitoring for unauthorised hosts and keeping network components patched.
The difference is that network location is no longer treated as sufficient proof that a request is safe. Secure transport is also important. Traffic should be protected against interception, tampering and impersonation using appropriate cryptographic protocols.
That is where technologies such as TLS remain important. Encryption protects data in transit, while Zero Trust policy determines whether the connection should be permitted in the first place.
Where packet inspection fits
Zero Trust does not require every decision to be made by inspecting application payloads. Identity, endpoint telemetry, certificates, authentication events, device posture and service context can all provide signals without reading the content of every connection.
Traditional network controls may still use packet inspection where appropriate. In a Zero Trust design, monitoring often shifts toward users, devices and services because encrypted and decentralised traffic may not pass through one central inspection point.
A practical Zero Trust access example
Consider an employee trying to open an internal finance application from home. A traditional remote-access design might establish a VPN and then allow the laptop onto a corporate subnet. A Zero Trust design can make a narrower decision about the finance application itself.
Identify the employee and the device requesting access.
Authenticate the employee using strong authentication, such as MFA or a phishing-resistant credential.
Check whether the device is registered, supported, patched and compliant with security policy.
Evaluate context such as location, time, recent behaviour and the sensitivity of the finance application.
Authorise only the finance application and only the actions the employee's role requires.
Protect the connection using secure transport.
Continue monitoring. If the device becomes non-compliant or the behaviour changes materially, require another check or revoke access.
Zero Trust at home
Zero Trust is primarily an enterprise architecture, but some principles are useful on advanced home networks. You can avoid giving every device unrestricted access to everything else, separate less-trusted smart devices, use strong authentication for important services, keep devices patched and avoid assuming that a device is safe merely because it is connected to your WiFi.
A home VLAN setup is not automatically Zero Trust. It can provide useful segmentation, but full Zero Trust involves identity-aware, policy-driven access decisions and continuous confidence signals that typical consumer routers do not implement.
Zero Trust and UK broadband
Zero Trust is largely independent of the underlying UK access network. The same principles can be applied whether a user reaches a service over Openreach FTTP, CityFibre, another altnet, cable, fixed wireless or mobile broadband. The broadband connection provides reachability. The Zero Trust architecture controls access to the organisation's resources.
Faster broadband can improve the user experience of remote applications, but it does not make the access decision more trustworthy. A 1 Gbps FTTP connection and a 100 Mbps connection can present the same identity and device risk. Security policy and line speed are separate concerns.
Common Zero Trust misconceptions
Zero Trust means trust nobody
Not literally. The architecture builds enough confidence in a specific request to authorise it. The important change is that trust is not inherited automatically from network location.
Zero Trust is a product
No. Products can provide identity, endpoint, policy, access and monitoring capabilities, but Zero Trust is an architectural approach. Buying one product does not make an organisation Zero Trust.
Zero Trust replaces firewalls and segmentation
No. Existing controls can remain useful. Zero Trust changes how access is decided and reduces reliance on perimeter trust, but network security, segmentation, endpoint security and monitoring still have roles.
Zero Trust means constantly entering passwords
No. Continuous verification is about continuously evaluating confidence, not repeatedly interrupting the user. Strong device identity, tokens, certificates and risk signals can support decisions in the background.
Zero Trust eliminates breaches
No. It is designed to reduce risk and limit the consequences of compromise. A vulnerable application, stolen session, compromised endpoint or incorrect policy can still create a security incident.
How to start moving towards Zero Trust
The NCSC recommends understanding the architecture and the risks before selecting technology. A sensible migration sequence is therefore driven by assets, identities and access requirements rather than by buying a branded Zero Trust product first.
Inventory users, devices, services, applications and important data.
Identify the highest-value resources and the threat scenarios you need to manage.
Strengthen user, device and service identities.
Introduce strong authentication and remove unnecessary standing access.
Define access policies around identity, device health, context and resource sensitivity.
Segment or isolate systems where broad network reachability is unnecessary.
Protect communications with authenticated encrypted transport.
Collect useful monitoring signals from users, devices and services.
Test policies with real workflows so security controls do not create unsafe workarounds.
Review and refine continuously. Zero Trust is an operating model, not a one-time migration checkbox.
Zero Trust troubleshooting and design checks
When a Zero Trust access path fails, the correct question is not simply 'is the network up?'. The network may be working perfectly while policy deliberately denies the request.
Confirm basic connectivity to the access or identity service.
Check that the user identity is valid and the expected authentication method completed.
Confirm the device identity and management state.
Check device health signals such as supported OS version, patch state and security tooling.
Review the access policy for the requested application or data.
Check whether location, time, risk score or behaviour changed the decision.
Confirm that the service identity and certificates are valid where service-to-service authentication is used.
Check secure transport and certificate errors.
Review policy-engine and enforcement-point logs for the actual deny reason.
Retest after correcting the failed condition rather than weakening the policy globally.
Zero Trust Networking FAQs
What does Zero Trust Networking mean?
It means removing inherent trust from network location and verifying access requests against policy using identity, device and contextual signals.
Is Zero Trust the same as ZTNA?
No. Zero Trust is the broader security architecture. ZTNA is one way of providing policy-controlled access to applications or resources using Zero Trust principles.
Do I still need a VPN with Zero Trust?
Possibly. Some ZTNA deployments can replace traditional remote-access VPN use cases, but VPNs and Zero Trust are not mutually exclusive. The right design depends on the applications, protocols, users and security requirements.
Does Zero Trust require MFA?
The NCSC's current Zero Trust guidance states that MFA is a requirement for a Zero Trust architecture. Strong authentication is one of several signals used to establish confidence in a request.
Is a VLAN a Zero Trust network?
No. A VLAN provides Layer 2 network separation. It can support a broader segmentation strategy, but Zero Trust requires identity-aware, policy-driven access decisions rather than network separation alone.
Does Zero Trust make broadband faster or slower?
Zero Trust is a security architecture, not a broadband speed technology. Authentication, policy checks, proxies or encrypted tunnels can add some processing or latency depending on the design, but the underlying FTTP, cable, fixed wireless or mobile line rate is separate.
Authoritative UK guidance
For organisations implementing this model, the National Cyber Security Centre Zero Trust guidance is the primary UK reference used for the principles explained in this article. The guidance was reviewed in January 2026 and covers architecture, identity, policy, monitoring, secure transport and ZTNA.
The key takeaway
Zero Trust Networking changes the basis of an access decision. Instead of assuming that an internal network, VPN connection or familiar IP address makes a request trustworthy, it asks who or what is requesting access, whether the device and context are acceptable, what resource is being requested and what policy allows. The result should be narrowly scoped access that can be re-evaluated as conditions change.
To explore the related technical concepts used in this Zero Trust Networking guide, visit our broadband terminology guide.
