Zero Trust is an identity project wearing a network costume

Every organisation now runs a network its original design never anticipated: staff at home, workloads in three clouds, contractors on unmanaged devices, and a hundred SaaS applications the network team does not route to. The perimeter did not fail so much as become irrelevant, and Zero Trust is the architecture that follows from admitting it.

What Zero Trust actually requires

Strip the marketing and three things remain. Every access request is authenticated and authorised explicitly, on the identity and the device posture, every time. Access granted is the least that will do the job, for the shortest useful period. And the architecture assumes breach — segmentation, monitoring and blast-radius limits exist because something will eventually be inside.

Note what is missing from that list: any specific product. Zero Trust is a set of properties. Vendors sell components that help you reach them.

ZTNA in place of the VPN

• Access is per-application, not per-network. A user reaching the finance app does not reach the subnet it lives on.
• Device posture participates in the decision — patch level, disk encryption, agent health.
• Sessions are re-evaluated rather than granted once at login.
• Applications stop being internet-reachable, which removes an entire class of exposure.

SASE and where the claims break down

SASE bundles network and security functions into a cloud-delivered edge: secure web gateway, CASB, firewall-as-a-service and ZTNA, ideally with SD-WAN. The value is real — one policy, one enforcement point, fewer backhauls. The caveats are also real: single-vendor bundles vary enormously in the maturity of each component, latency depends on the provider point of presence nearest your users, and TLS inspection carries privacy and performance costs you must decide about deliberately.

OT and IoT are the segmentation test

Nothing exposes an unsegmented network faster than a building management system or a production line. These devices cannot be patched on your schedule, often cannot run an agent, and frequently speak protocols with no authentication. They belong behind a boundary you monitor, with explicitly allowed flows and nothing else.

The SOC is what makes it real

An architecture nobody watches degrades quietly. Network telemetry — flow data, DNS, proxy logs, ZTNA decisions — is some of the highest-value detection material available, and it is routinely collected and ignored. Detection engineering against that data is what turns a Zero Trust project into a security outcome.

Before buying anything, write down which applications should be reachable by which identities. Most Zero Trust programs stall because that list has never existed.