--- title: "Zero Trust — Identity Glossary | IDSync" description: "Zero Trust is a security model that assumes no implicit trust based on network location and instead verifies every access request against identity, device…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "Zero Trust", "item": "https://idsync.com/glossary/zero-trust" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/zero-trust", "name": "Zero Trust", "alternateName": [ "Zero Trust Architecture", "ZTA" ], "description": "Zero Trust is a security model that assumes no implicit trust based on network location and instead verifies every access request against identity, device posture, and context before granting least-privilege access.", "url": "https://idsync.com/glossary/zero-trust", "inDefinedTermSet": "https://idsync.com/glossary" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is Zero Trust the same as ZTNA?", "acceptedAnswer": { "@type": "Answer", "text": "No. ZTNA (Zero Trust Network Access) is the network-access component — replacing VPNs with identity-and-context-aware app access. Full Zero Trust covers identity, device, app, and data pillars in addition to network." } }, { "@type": "Question", "name": "Does Zero Trust eliminate the need for a firewall?", "acceptedAnswer": { "@type": "Answer", "text": "No. It changes where you place trust. Network controls are still useful as defense in depth." } } ] } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. Zero Trust Architecture # Zero Trust Zero Trust is a security model that assumes no implicit trust based on network location and instead verifies every access request against identity, device posture, and context before granting least-privilege access. Last reviewed 3 months ago Key points - The shorthand is 'never trust, always verify' — replacing the old perimeter model. - Identity is the new perimeter: every access decision starts with strong authentication of the user and device. - Key pillars (per NIST SP 800-207): identities, devices, networks, applications, data — all governed by continuous, policy-driven verification. - ZTNA (Zero Trust Network Access) is the network/access slice; full Zero Trust is broader. - Zero Trust is an architecture, not a product — every major identity vendor sells into it. ## What is Zero Trust? Zero Trust is a security architecture built on the principle that **no user, device, or workload should be trusted by default** — not because it's inside the corporate network, not because it's on a managed laptop, not because it once authenticated successfully. Every access request is evaluated against identity, device posture, and contextual signals, granted with least privilege, and continuously re-verified. NIST SP 800-207 is the canonical reference. CISA's Zero Trust Maturity Model provides a practical roadmap across five pillars: identities, devices, networks, applications & workloads, and data. ## Why the old model broke The traditional perimeter model treated "inside the corporate network" as trusted. That worked when employees sat at desks behind a firewall and apps ran in your own data center. It stopped working when: - Apps moved to SaaS — the "perimeter" is now Salesforce, Slack, GitHub, AWS. - Employees moved to coffee shops, homes, and the road. - Attackers proved they could pivot inside the network once they got past the perimeter (every major breach since 2013). - Contractors, partners, and BYOD made "inside" meaningless. ## How identity fits In every credible Zero Trust reference, identity is the foundation: - Strong, ideally [phishing-resistant MFA](/glossary/phishing-resistant-mfa) at the IdP. - [SSO](/glossary/single-sign-on) as the policy enforcement point in front of every app. - Device posture (managed, encrypted, patched) as a signal. - Continuous, risk-adaptive evaluation — not just at login. - Least-privilege, [just-in-time](/glossary/just-in-time-access) access for sensitive resources. This is why IAM vendors (Okta, Microsoft, Ping, Cisco Duo) and ZTNA vendors (Zscaler, Netskope, Cloudflare, Palo Alto) all credibly claim to "do Zero Trust" — they each cover a pillar. ## When buyers care Zero Trust shows up on the roadmap when: - The board mandates a Zero Trust strategy (very common since 2021–2022). - US federal customers cite OMB M-22-09 / Executive Order 14028. - Cyber insurance asks specifically about it. - A breach (yours or a peer's) makes "trust the network" look indefensible. ## Common pitfalls - **Buying a "Zero Trust product."** No single product delivers ZTA; it's an architecture built from identity, device, network, and data controls. - **Stopping at ZTNA.** Network-only Zero Trust without strong identity and governance is half a strategy. - **Treating it as a one-time project.** Maturity models are stage-gated for a reason. ## FAQ ### Is Zero Trust the same as ZTNA? No. ZTNA (Zero Trust Network Access) is the network-access component — replacing VPNs with identity-and-context-aware app access. Full Zero Trust covers identity, device, app, and data pillars in addition to network. ### Does Zero Trust eliminate the need for a firewall? No. It changes where you place trust. Network controls are still useful as defense in depth. ## Standards & references - [NIST SP 800-207 — Zero Trust Architecture](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf) - [CISA Zero Trust Maturity Model](https://www.cisa.gov/zero-trust-maturity-model) IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [iam platforms](/directory/category/iam-platforms)[pam](/directory/category/pam)[mfa](/directory/category/mfa) ### Related terms [ztna](/glossary/ztna)[single sign on](/glossary/single-sign-on)[multi factor authentication](/glossary/multi-factor-authentication)[just in time access](/glossary/just-in-time-access) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the iam platforms category. [Explore tools](/directory/category/iam-platforms) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.