Zero trust What is zero trust?
Zero trust is a newer model of cybersecurity designed to better address changing security requirements for modern organizations. Zero trust frameworks can improve security posture, limit lateral movement throughout the network, and prevent data breaches.
Time to read: 9 minutes 8 seconds | Updated: October 26, 2026
Table of Contents
Key takeaways for zero trust
Zero trust is a security model that grants no implicit trust based on network location or ownership. Every access request is verified before users, devices, or workloads can reach protected resources.
- It verifies explicitly: Authenticate and authorize every request using identity, device health, location, behavior, and risk signals.
- Applies least-privilege access: Grant only the minimum permissions needed, for the shortest required time.
- Assumes breach: Continuously monitor activity, limit exposure, and enable rapid threat detection and containment.
Zero trust explained
The complexity of today's cyberattacks, expansive attack vectors, and constant threats can often paralyze even the nimblest enterprises. Zero trust security helps simplify your approach to security, to make managing your environment easier.
Essentially, the zero trust security model replaces faith in the integrity of secure network perimeters (such as private networks, firewalls, and VPN/VPC) with that of the individual software systems which are managing critical data.
Hewlett Packard Enterprise has recognized that, for customers and partners to be able to deliver a robust and agile zero trust security solution for their most critical data systems, trust must be built into everything they use—from the silicon that runs the software to the network that connects users and devices to the applications and data they need.
How does zero trust work?
To enhance security in modern enterprises where users and devices are remote and threats are bypassing traditional perimeter defenses, it's critical to have a rigorous security model that performs checks on a continuous basis. Before accessing the network, all devices and users should be identified and authenticated and given the least amount of access required, and then continuously monitored.
How does zero trust work?
Implement a zero trust architecture by incrementally replacing implicit trust with explicit verification, least-privilege access, and continuous monitoring. Start by identifying the users, devices, applications, workloads, and data you need to protect. Map how they communicate, classify sensitive resources, and assess existing security controls to uncover visibility and enforcement gaps. Prioritize a manageable use case, such as securing remote access to a critical application, and establish shared responsibilities across networking, security, and identity teams. Define measurable goals for access coverage, policy consistency, and user experience before expanding deployment.
Next, establish reliable identities and context-based access policies. Authenticate users with strong methods, including multifactor authentication, and identify devices through certificates, discovery, and profiling where supported. Evaluate device health, identity, resource sensitivity, and other risk signals before authorizing access. Grant only the permissions required for a specific task, limit their duration where appropriate, and regularly review privileges. Apply these principles to every subject on the network – including human and non-human identities such as IoT devices and AI agents. For devices that cannot support standard authentication, use profiling and tightly restricted access rather than treating their network location as proof of trust.
Enforce those policies wherever resources are accessed: campuses, branches, data centers, cloud environments, and remote locations. Use network access control and identity-based segmentation to restrict device connectivity and limit lateral movement. Encrypt communications and integrate identity, endpoint, network, and application controls so enforcement reflects consistent policy. Finally, continuously monitor access decisions, device posture, and activity to detect changes in risk. Reassess active sessions and require additional verification, restrict permissions, or terminate access when warranted. Integrate telemetry and automate appropriate responses to reduce operational delays. Test that policies permit legitimate work and block unauthorized access, documenting exceptions and remediation plans. Expand the architecture in phases, using pilot results to refine controls, address legacy constraints, and improve performance. Zero trust is a journey and it is not a single product, so treat implementation as an ongoing process of verification, measurement, and improvement—not a one-time deployment.
How is zero trust different from perimeter-based security?
Unlike traditional security approaches focused primarily on the perimeter, modern zero trust security architectures recognize trust as a vulnerability. They assume no user or device—regardless of how or where they connect—should be trusted by default because the user could be compromised. Identity and device attestation and authentication are required throughout the network. Every component in the network must independently establish its trustworthiness and be authenticated by any other component it interacts with, including existing point security measures.
What are the core principles of zero trust?
- No implicit trust: Always authenticate and authorize based on all available contextual data, such as user identity, location, time of day, device posture, and the application being accessed. Trust is never assumed.
- Least privilege access: Grant users and devices only the permissions necessary to perform their specific tasks, and only as long as they are behaving consistently with their role. This minimizes the risk of unauthorized access and lateral movement of attack within the network.
- Assume breach: Design systems under the assumption that a breach has already occurred or could occur at any time. Focus security capabilities on detecting, containing, and minimizing impact.
- Micro-segmentation: Divide the network into smaller, isolated zones to limit access and reduce the attack surface. Even if one zone is compromised, the rest remain secure.
- Continuous monitoring and validation: Monitor device behavior, device status, and access patterns to detect anomalies and enforce policies in real time.
- Device and identity-centric security: Tie security policy to identity and role rather than location (where the user or device is connecting from, e.g., within the network perimeter). This is critical in cloud and hybrid environments and for remote workforces.
HPE Aruba Networking security-first, AI-powered networking activates zero trust principles intrinsically at every point of connection to provide a comprehensive set of capabilities that span visibility, control, and enforcement to address the requirements of a decentralized, IoT-driven network infrastructure.
What are the benefits of zero trust?
Network security is increasingly challenging because of mobility, IoT, and telecommuting environments. Zero trust allows you to increase visibility, control, and enforcement to address the security requirements of a decentralized, IoT-driven network infrastructure.
- Limits exposure to security risks related to vulnerable IoT devices.
- Helps reduce the risk of advanced threats that bypass traditional perimeter security controls.
- Limits damage related to lateral movement by attackers and infected devices.
- Takes a more holistic approach to security regardless of who or what is connecting and from where.
- Enables application of best practices such as micro-segmentation to support least-privilege access.
Where do I start with zero trust?
Zero trust architectures focus on authentication, authorization, and continual risk management. Here's how to get started:
1. Eliminate network blind spots by discovering and profiling all devices connected to the network.
2. Verify identity before allowing access using 802.1X-based authentication techniques, as well as emerging solutions for IoT devices.
3. Compare endpoint configuration to compliance baselines and remediate as needed.
4. Establish least-privilege access to IT resources by segmenting traffic based on identity-based policies.
5. Continuously monitor the security state of the user and device, and bi-directionally communicate with other elements in the security ecosystem. Establish policies to revoke a user or device's access rights in cases of compromise or attack.
What are the differences between zero trust and SASE?
Zero trust and Secure Access Service Edge (SASE, pronounced "sassy") are two approaches to enhance security as workforces become increasingly remote and dispersed, and organizations' attack surfaces expand.
SASE defines the components needed to provide optimized, secure access at the edge. It combines comprehensive wide area network (WAN) capabilities including SD-WAN, routing, and WAN optimization with cloud-delivered security services such as SWG, CASB, and ZTNA. A SASE solution must be able to identify sensitive data, plus encrypt and decrypt content with continuous monitoring for risk and trust levels. This approach is particularly useful for organizations with multiple remote and branch offices and highly distributed workforces.
Zero trust is a model and philosophy meant to reduce security risk across the enterprise by eliminating the concept of implicit trust and instead enforcing least-privilege access based on continuously monitored identity-based authentication and authorization. It encompasses not just secure access but also monitoring of cyberthreats to the organization, data governance and compliance requirements, and maintenance of the network environment.
Zero trust and SASE have overlapping principles. Implementing a SASE solution can be one step in an organization's journey to a complete zero trust security architecture.
How can HPE help with achieving a zero trust architecture?
Project Aurora is HPE's edge-to-cloud zero trust security architecture to help protect customers from some of today's most sophisticated malware attacks. Building on HPE's silicon root of trust, Project Aurora measures everything before it is enabled or released for execution and continuously repeats this measurement during runtime.
Rather than being a point solution, Project Aurora addresses end-to-end security for edge-to-cloud deployments, with new embedded and integrated security solutions starting at the silicon level. It incorporates designed-in security technologies with automated verification and attestation to establish a defense-in-depth approach that begins at the lowest foundational layer—the silicon.
By embedding security across a secure chain of trust from the silicon to the workload, Project Aurora will make it possible for organizations to place greater assurance in their distributed software systems, allowing for more agility and flexibility to bring cost-effective and differentiating solutions to market.
Project Aurora will lay the foundation for delivering more zero trust services across GreenLake and other HPE offerings. Initially, it will be embedded within GreenLake Lighthouse to automatically and continuously verify the integrity of the hardware, firmware, operating systems, platforms, and workloads, including workloads from security vendors. This can help minimize the loss and unauthorized encryption (and corruption) of valuable enterprise data and intellectual property.
In the future, Project Aurora will be embedded within GreenLake cloud services to provide a platform-agnostic way to define, create, and deploy a zero trust architecture distributed from edge to cloud.
Zero trust FAQs
What are the pillars of zero trust security?
The pillars of zero trust security are:
- Visibility—knowing who and what is on your network and constantly scanning for change
- Authentication and authorization—assigning appropriate access privileges based on the confidence level organizations have as to who and what is on their network
- Enforcement of least-privilege access—granting access to only the resources needed for a subject to their job or fulfil their role
- Continuous monitoring—ensuring that once a user or device is on the network, they are behaving consistently with their role/who they are attesting to be
- Adaptive response—when an anomaly is detected or contextual data signals a threat, the ability to act and remediate the threat and stop the threat
What is the difference between zero trust and traditional network security?
Network security involves using hardware, software, and as-a-service (aaS) solutions to protect edge-to-cloud network infrastructure from cyberattacks, data loss, and misuse. Network security technology can include firewalls (including next-generation firewalls and hybrid mesh firewalls), intrusion detection and prevention systems, data encryption, and secure network access controls. Zero trust is a cybersecurity model that replaces perimeter-based trust with adaptive trust based on an assumption that breach has already occurred. Instead of trusting users or devices inside the corporate network by default, zero trust entails continuously verifying identity, device posture, and context, enforcing least-privilege access, and limiting lateral movement to reduce the impact of compromised accounts or systems. Network security is part of an effective zero trust architecture.
Can zero trust replace a VPN?
VPN replacement is part of a zero trust architectural strategy. VPNs for many remote-access use cases grant authenticated users access overly broad access to applications, leaving organizations vulnerable. Zero trust access to applications can be enabled through the use of zero trust network access solutions, keeping remote users and authorized third parties, such as contractors, off the corporate network and granting least privilege access to only the applications needed to do their jobs.
How does zero trust secure cloud environments?
Zero trust approaches can secure cloud environments by verifying every access request, enforcing least-privilege permissions, and applying consistent policies across users, workloads, and applications. Continuous monitoring, identity-based controls, and segmentation help prevent unauthorized access, limit lateral movement, and reduce the risk of compromised credentials or workloads across hybrid and multicloud environments.
What should an enterprise look for in a zero trust solution?
Keep in mind that zero trust is not a single product or solution but rather a strategic approach. Evaluate solutions that will make it easier to implement change and maintain systems once they are deployed. Solutions with built-in zero trust security controls can help streamline architectures, reduce complexity, and eliminate gaps and inconsistencies created by using a fragmented or patchwork approach. Identity-aware access controls, continuous verification, least-privilege enforcement, and granular segmentation across users, devices, applications, workloads, and locations are key. In addition, consider prioritizing consistent policy management, integration with existing security tools, real-time visibility, automated threat response, AI-automated operations for scalability and response at machine speed, and support for hybrid environments.
How does zero trust protect data centers?
Zero trust strategies that operate on "east-west" traffic can protect data centers by verifying identities and authorizing intra-data center access between users, devices, applications, and workloads. Microsegmentation limits lateral movement, while least-privilege policies restrict access to critical systems and sensitive data. Continuous monitoring and context-aware enforcement help detect suspicious activity, contain compromised assets, and reduce the risk of widespread breaches.
How does zero trust secure remote workers?
Zero trust strategies can secure remote workers through solutions like zero trust network access (ZTNA) that verify user identity, device health, and contextual risk before granting access to specific applications and resources. Enforcement of least-privilege policies limit exposure, while continuous verification adapts access as conditions change. This helps prevent unauthorized access from compromised devices and supports secure work from virtually anywhere.
What are the biggest challenges of implementing zero trust?
The biggest challenges to implementing zero trust include fragmented security tools, lack of visibility, location-dependent access policies, limited visibility, and inconsistent enforcement from edge to cloud. Organizations may also face skills gaps, budget constraints, and legacy systems. Successful implementation of zero trust often include a phased roadmap, clear ownership across teams, integration across environments, and measurable outcomes that can be repeated, rather than attempting to replace every security control at once.