For decades, corporate networks were built like a castle: a strong wall at the edge, and anyone already inside was trusted. Once a laptop was on the office LAN or connected through the VPN, it could usually reach file servers, databases and management consoles. Attackers adapted by getting one foothold inside, often a single phished password, and then moving freely.
Zero Trust is the response to that failure. On the CompTIA Security+ SY0-801 exam it sits under objective 1.1, which expects you to explain the core concepts behind security controls, including the principles Zero Trust is built on. This lesson covers those principles: removing location-based trust, verifying every request, assuming breach, granting least privilege one resource and one session at a time, and verifying continuously. It also shows how exam scenarios describe them.
Zero Trust removes trust that comes from network location
Zero Trust is a security model in which no user, device or connection is trusted by default because of where it sits on the network. Being on the office LAN, the data center subnet or the VPN earns nothing. Every request to a resource is judged on who is asking, from what device, in what context and for what.
The older perimeter model drew a line between an untrusted outside and a trusted inside. That line has been eroding for years. Applications moved to SaaS and cloud platforms outside the firewall. Employees work from home, hotels and phones. Contractors and partners need access to some systems but not others. And attackers who phish one user land inside the trusted zone with that user's reach. A model that trusts the inside can't cope with any of these.
The model was popularized by John Kindervag at Forrester Research around 2010, and Google rebuilt its own internal access around the idea in a project called BeyondCorp. The standard reference today is NIST Special Publication 800-207, published in 2020. U.S. federal agencies were directed toward Zero Trust by Executive Order 14028 in 2021 and an OMB memo, M-22-09, in 2022.
Zero Trust is a strategy and a set of principles, not a product. Vendors attach the label to many tools, but no single purchase delivers it. How the principles are put into practice, with policy decision and enforcement points, device health and inventory checks and per-application access, is covered in the Zero Trust architecture section.
Never trust, always verify means every request is checked on its merits
The best-known Zero Trust phrase is "never trust, always verify." It means every access decision is made explicitly, using as many signals as are available, instead of being assumed from a previous check or a network address.
The signals usually fall into three groups:
- Identity: who the user or service is, and how strongly they authenticated. A phishing-resistant method counts for more than a password alone.
- Device: whether the device is known and managed, patched, encrypted and running its endpoint protection.
- Context: the sensitivity of the resource, the time, the location, and whether the behavior matches the user's normal pattern.
The same rules apply wherever the request comes from. A laptop plugged into a jack at headquarters is checked exactly like one on hotel Wi-Fi, and traffic is encrypted on the internal network just as it is on the internet.
Here is what two decisions for the same user might look like in an access log:
2026-10-21T09:12:44Z decision=ALLOW resource=hr-portal user=mlopez auth=fido2
device=LT-4471 managed=yes patched=yes edr=running disk_encrypted=yes
2026-10-21T19:40:02Z decision=ALLOW_LIMITED resource=hr-portal user=mlopez auth=fido2
device=unknown managed=no restrictions=browser-only,no-downloads
The user is the same and authenticated just as strongly both times. The device changed, so the decision changed. That is explicit verification at work: access depends on everything known about the request, and the answer can be yes, no or a restricted yes.