Zero trust is the security model that replaces VPN-centric perimeter security with continuous verification of every request regardless of source network. The model was formalized in Google's BeyondCorp research (2014) and became mainstream in 2020-2022 as remote work made perimeter security obsolete. NIST SP 800-207 (Zero Trust Architecture) is the definitive reference.
The core principle: never trust, always verify. A user on your corporate network has the same level of implicit trust as a user on a coffee shop WiFi — which is zero. Every request must present verifiable identity, a trusted device posture, and context-appropriate authorization. This eliminates the lateral movement path that defines most enterprise breaches: attacker compromises a machine on the internal network, then pivots freely to other internal systems because "internal = trusted."
Four pillars in practice: Identity verification via a modern IdP (Okta, Azure AD, Google Workspace) with MFA enforced for all users, including service accounts. Device trust via endpoint verification — the requesting device must meet a baseline (OS version, disk encryption, EDR agent running) before access is granted. Microsegmentation of services, so a compromised payment service can't directly reach the HR database. Continuous monitoring with anomaly detection, not just point-in-time authentication.
For teams migrating from VPN: Cloudflare Access, Tailscale, and Twingate are the practical ZTNA (Zero Trust Network Access) products. Cloudflare Access sits in front of internal applications, authenticates users with your IdP, and provides a public URL without exposing the origin. Tailscale creates a WireGuard mesh network where devices authenticate with your SSO — no VPN concentrator, no firewall rules. Both products can replace a VPN for developer access to internal services in a week of implementation effort.
For larger enterprises: Google BeyondCorp Enterprise, Zscaler Private Access, and Palo Alto Prisma Access are the enterprise ZTNA platforms. They add device posture checking, data loss prevention, and centralized policy management.
The common mistake: treating zero trust as a product purchase rather than an architecture shift. You can buy Zscaler and still have an implicit trust network if your application authorization isn't updated to verify identity at every API call.