What Is Zero Trust?
Zero trust is a security model that grants no implicit trust to any user, device, or connection based on network location, and instead verifies every access request against policy before allowing it. It enforces least-privilege per-request access decisions with the network treated as already compromised (opens in new tab), a formulation NIST codified in Special Publication 800-207 in 2020.
Zero trust architecture (ZTA) is the enterprise cybersecurity plan that puts those concepts into practice, covering component relationships, workflow planning, and access policies.
How zero trust works
Every access request passes through a policy decision before the policy administrator establishes a connection, using three logical components NIST SP 800-207 describes. Enterprise policy and external signals, such as threat intelligence and continuous diagnostics data, feed the policy engine (PE), which makes the grant, deny, or revoke decision through a trust algorithm and functions as the decision-making brain (opens in new tab) of a ZTA.
The policy administrator (opens in new tab) (PA) executes that decision, generates the session credential, and establishes or terminates the connection. The policy enforcement point (PEP) sits in the data path, opening, monitoring, and closing the connection between subject and resource on the PA's instruction.
The trust algorithm evaluates access context continuously, weighing the requested resource, device health, the subject's role and behavior history, and current threat intelligence. The PE grants access on a per-connection basis (opens in new tab), so it can revoke or narrow that access mid-session as the user's or device's observable state changes.
A finance analyst opens the payroll application from a managed laptop. The PEP forwards the request. The PE checks identity, device health, resource sensitivity, and location, consistent with NIST SP 1800-35 (opens in new tab), and the PA issues a session token scoped to that one application.
Twenty minutes later the endpoint agent reports that disk encryption is disabled. The PE re-evaluates and the PA terminates the session. Network location alone did not determine either decision.
Why zero trust matters
Perimeter-based security grants implicit trust (opens in new tab) based on network location, which can give an attacker room to move across internal systems. The model protects resources individually (opens in new tab), since remote users and cloud assets already sit outside a fixed enterprise perimeter.
Zero trust operates on an "assume breach" (opens in new tab) footing: it defends as though an adversary already has a foothold, denies by default, and continuously logs and inspects access.
Regulators expect the same controls. Federal agencies began moving toward zero trust under Executive Order 14028 (opens in new tab) (May 12, 2021) and worked toward pillar-level targets (opens in new tab) in OMB M-22-09 (January 26, 2022) for the end of fiscal year 2024.
Department of Defense components must reach target-level zero trust (opens in new tab) by September 30, 2027, and under the amended NYDFS Part 500, fully in effect since November 1, 2025 (opens in new tab), covered entities must use multi-factor authentication for all individuals accessing information systems.
In practice, these requirements converge on least privilege, MFA, segmentation, and continuous monitoring, regardless of which vendor architecture an organization chooses.
The model's boundary is the enterprise resource itself, so attackers who can't break authentication go around it instead. Adversaries increasingly exploit human trust (opens in new tab) through interactive, voice-based social engineering aimed at IT help desks and identity-recovery workflows, bypassing MFA without touching the network layer at all.
Brand impersonation aimed at customers uses spoofed domains, fake social profiles, and fraudulent apps on platforms entirely outside an enterprise ZTA's control plane.
Core components of zero trust
Zero trust decomposes into five pillars (opens in new tab) in CISA's Zero Trust Maturity Model Version 2.0 (April 11, 2023), each advancing through Traditional, Initial, Advanced, and Optimal maturity stages.
- Identity. Security teams authenticate and authorize every human and non-human account, using controls such as MFA and privileged access management, with continuous authentication (opens in new tab) throughout a session.
- Devices. Teams inventory and assess the health of every asset that requests access, keeping systems in the most secure state possible and actively monitoring them (opens in new tab).
- Networks. Teams secure all communication regardless of location, so traffic inside the corporate network receives the same scrutiny as traffic from the internet.
- Applications and workloads. The PE grants access per connection, scoped to one application, which limits a compromised account's ability to roam to other resources.
- Data. Security teams classify and encrypt data and apply access policy to the data itself. Zero trust is a data-centric security model (opens in new tab) that constantly limits access while watching for anomalous activity.
Three cross-cutting capabilities (opens in new tab) span all five pillars: visibility and analytics, automation and orchestration, and governance.
How to implement zero trust
Build in this order rather than closing every pillar gap before moving to the next:
- Define the protect surface first. Map the critical data, applications, assets, and services (DAAS), then trace how transactions flow to and from them. Forrester's five-step method (opens in new tab) then architects controls around those flows and writes Layer 7 policy using the Kipling Method (who, what, when, where, why, how), then monitors and adjusts.
- Migrate one business process at a time. A practical rollout runs zero trust and perimeter controls together in a hybrid model, keeping identity management, device management, and event logging flexible enough to serve both, per NIST guidance. NIST SP 1800-35 (opens in new tab) (June 2025) walks through example implementations built this way from commercial products.
- Resist a rigid checklist. Treating the five pillars as a strict left-to-right sequence (opens in new tab) can stall a program, particularly when teams try to close every identity gap before starting device work.
- Prioritize phishing-resistant MFA. FIDO- and PKI-based authenticators qualify; push bombing and SS7 and SIM-swap attacks don't apply (opens in new tab) to them.
None of these steps wait for the others to finish. Continuous verification (opens in new tab) still matters after login, since zero trust treats a completed sign-in as provisional, not permanent.
How Doppel helps
Doppel is the Frontier AI Social Engineering Defense (SED) platform that unifies Digital Risk Protection (DRP) and Human Risk Management (HRM). Zero trust decides who reaches an enterprise resource; social engineering targets people before an access request exists, and brand impersonation targets customers outside the network entirely.
Its DRP detects multi-channel impersonation across domains, social media, paid ads, app stores, telco, and the dark web; links fake domains and spoofed profiles into a single campaign in the Doppel Threat Graph; and dismantles the attacker infrastructure behind it.
Agentic AI correlates, prioritizes, and executes takedowns at scale, and analysts handle the escalations that need human judgment.
Its HRM tests help desk calls and SMS pretext in workflows a ZTA cannot govern, including deepfake voice on Microsoft Teams calls. Simulations run these scenarios live for employees and help desk staff, and Security Awareness Training assigns follow-up by measured risk.
Paired with a mature ZTA, the simulations expose gaps in identity-recovery and impersonation workflows before attackers can exploit them.
Request a demo to walk through a live Threat Graph campaign view and a takedown from detection to dismantled infrastructure.
Frequently asked questions about zero trust
What is zero trust?
Zero trust is a security model in which no user, device, or connection gets access because of its network location. A zero trust architecture (ZTA) authenticates, authorizes, and continuously verifies every request against policy before and during access. Forrester's John Kindervag (opens in new tab) founded the concept in 2009 on the principle of verifying explicitly rather than trusting by default. Organizations deliver it through identity, device, network, application, and data controls.
Zero trust vs. least privilege: what is the difference?
Zero trust is a framework; least privilege is a principle within it. Zero trust governs how an organization verifies access, while least privilege defines how much access it grants once verified. Least privilege, per-connection access, securing all communication regardless of location, and policy that changes with context are among the seven tenets in National Institute of Standards and Technology Special Publication (NIST SP) 800-207. A zero trust architecture blocks unauthorized access at every step; least privilege limits the damage if an attacker compromises an authorized identity anyway.
What is an example of zero trust?
Picture the payroll scenario above: a managed device, a sensitive application, and a policy engine that re-evaluates access as conditions change rather than trusting a completed login indefinitely. National Institute of Standards and Technology Special Publication (NIST SP) 1800-35 (June 2025) documents multiple example implementations (opens in new tab) built from commercial products, so teams don't have to design the pattern from scratch.