Zero Trust Architecture (ZTA) is a security philosophy and design framework that replaces the traditional perimeter-based security model with one simple principle: never trust, always verify. The model was formalised by NIST in Special Publication 800-207, and has since become the baseline security expectation for regulated enterprise environments globally.
The traditional model assumed that anything inside the corporate network perimeter could be trusted. Zero trust rejects this assumption entirely — because the perimeter no longer exists in a meaningful sense (remote work, containerised workloads, multi-cloud, APIs), and because internal threats are statistically more dangerous than external ones.
The four pillars of real zero trust
1. Machine identity (not just user identity). Every service, pod, and process must have a cryptographic identity — not a shared secret or a static API key. The SPIFFE/SPIRE framework issues short-lived X.509 SVIDs (SPIFFE Verifiable Identity Documents) that expire in 1–4 hours, eliminating the risk of long-lived credential compromise.
2. Policy as code. Access decisions must be governed by machine-readable policies stored in version control — not manually configured firewall rules or group membership. OPA (Open Policy Agent) enables policy decisions to be audited, tested, and reviewed like software.
3. Mutual TLS everywhere. All service-to-service communication must be encrypted and mutually authenticated — meaning both sides prove their identity before any data is exchanged. A service mesh like Istio enforces this at the infrastructure layer, not the application layer.
4. Dynamic secrets. Databases, message queues, and APIs should issue short-lived credentials per session — not static passwords stored in environment variables. HashiCorp Vault's dynamic secrets engine generates credentials on demand and revokes them automatically.
What zero trust is not
Zero trust is not a product you buy. Vendors selling "zero trust" products almost universally mean user authentication products — ZTNA (Zero Trust Network Access) solutions that replace VPNs. These address one narrow slice of the problem (user identity) and ignore the far larger attack surface of service-to-service communication, secrets management, and policy enforcement. Buying a ZTNA product and calling it zero trust is the enterprise equivalent of installing a front door lock on a building with no walls.