What is zero trust architecture and how does it differ from perimeter security?

Traditional perimeter security assumed a trusted inside and an untrusted outside, defended by a firewall — the "castle and moat" model. Once inside, a user or device was largely trusted, so an attacker who got a foothold could move laterally with little resistance.

That model broke because there is no longer a meaningful perimeter: cloud services, remote work, personal devices, and third-party integrations all sit outside it.

Zero trust operates on "never trust, always verify". Its core principles:

• Verify explicitly. Every access request is authenticated and authorised using all available signals — user identity, device health, location, and behaviour — regardless of network position.
• Least privilege access. Just-in-time and just-enough access, so a compromised account has limited reach.
• Assume breach. Design as though an attacker is already inside: segment networks, encrypt internal traffic, and monitor continuously.

What it looks like in practice: strong identity as the control plane with conditional access policies, device compliance checks before access is granted, micro-segmentation so systems cannot reach each other without justification, per-application access rather than full VPN network access, and comprehensive logging.

Note: Emphasise that zero trust is an architecture and a strategy, not a product — vendors sell "zero trust solutions" but it is achieved through many controls working together. And it is implemented incrementally; a wholesale switch is not realistic for an existing estate.