In short: Zero trust security is an approach where no user, device or network is trusted by default. Every request to an application or piece of data is authenticated, authorised against policy and monitored, using signals about identity, device health and context. It is a strategy built up in stages, not a single product.
What zero trust is, and is not
Traditional security assumed that anything inside the office network could be trusted, so the job was to keep attackers out with a firewall and a VPN. That model breaks down when staff work from home, applications live in SaaS and Azure, and one phished password can give an attacker an "inside" foothold.
Zero trust turns the assumption round. Access is decided request by request, based on the identity of the user or service, the health of the device and the sensitivity of what is being accessed. The network is treated as hostile, even your own.
Two clarifications help:
- Zero trust is not a product. Vendors sell components that support it, but no single licence makes you zero trust.
- Zero trust is not the same as ZTNA. Zero trust network access is one component: the part that replaces the VPN for private applications. It is covered on our ZTNA page.
The NCSC zero trust architecture design principles
The NCSC publishes design principles for zero trust architecture, most recently reviewed in January 2026. They make a sensible checklist for UK organisations:
- Know your architecture, including users, devices, services and data
- Know your user, service and device identities
- Assess your user behaviour, devices and services health
- Use policies to authorise requests
- Authenticate and authorise everywhere
- Focus your monitoring on users, devices and services
- Don't trust any network, including your own
The same NCSC collection includes guidance on zero trust network access (ZTNA), which is worth reading before you replace a VPN.
The first principle is the one most often skipped. You cannot write good access policies until you know which users, devices, applications and data you have, and which of them matter most. That is why a zero trust programme usually begins with an assessment.
The five pillars
The US CISA Zero Trust Maturity Model groups the work into five pillars, with visibility, automation and governance running across all of them. The pillars are a useful way to see what you have and what is missing.
| Pillar | What it means | Typical controls | Our guides |
|---|---|---|---|
| Identity | Every user and service proves who it is, strongly, every time | MFA and phishing-resistant sign-in, conditional access, privileged access management, identity threat detection | Identity security, Microsoft Entra ID P1 and P2, ITDR |
| Devices | Only known, healthy devices get access to sensitive resources | Device management and compliance, EDR, posture checks at sign-in | Endpoint security and XDR |
| Networks | No implicit trust from network location; limit lateral movement | ZTNA instead of VPN, secure web gateway, microsegmentation | ZTNA, Zero Networks microsegmentation, SASE |
| Applications and workloads | Each app enforces access and is protected in its own right | Per-app access, SaaS controls, web application firewall, cloud workload protection | CASB, WAF, CNAPP |
| Data | Protection travels with the data | Classification and sensitivity labels, DLP, encryption, browser and AI controls | Data protection, browser security |
For device compliance in Microsoft environments, conditional access usually relies on Microsoft Intune; for mixed estates, Cisco Duo device trust is another route.
A staged zero trust roadmap
Zero trust is built up in stages over months, not switched on in a weekend. A practical order for most UK organisations:
- Inventory: list users, admin roles, devices, applications and where sensitive data lives. Decide what matters most.
- Strong identity: MFA for every account, phishing-resistant methods for admins, block legacy authentication and remove standing admin rights.
- Device health: manage and encrypt devices, deploy EDR, and require compliant devices for access to sensitive apps.
- Conditional access: write policies that combine user, device, location and risk, starting in report-only mode.
- Replace the VPN app by app with ZTNA, for example Microsoft Entra Private Access or another option on that page.
- Stop lateral movement with segmentation, so one compromised machine cannot reach every server.
- Protect data with labels, DLP and controls on unmanaged devices, browsers and AI tools.
- Monitor and respond across identity, endpoint, email and cloud, through MDR if you do not run your own security team.
Each stage reduces risk on its own, so you get value long before the roadmap is complete.
Products that support zero trust
Many organisations already own a good part of the toolkit. Microsoft Entra ID P1, included in Microsoft 365 Business Premium, provides conditional access; P2 adds risk-based policies and privileged identity management. The Microsoft Entra Suite adds Entra Private Access, Entra Internet Access and identity governance.
Beyond Microsoft, options we cover include Zero Networks for agentless microsegmentation and MFA in front of privileged ports, the Island Enterprise Browser for last-mile data controls on unmanaged devices, and SASE platforms such as NordLayer, Todyl, WatchGuard FireCloud and Timus SASE from Timus Networks, which combine zero trust access with web protection and cloud firewall features in different ways. The right mix depends on what you already run, which is why we compare options rather than lead with one.
Common pitfalls
- Buying a product and calling it zero trust, without changing access policies.
- Exceptions that never close: break-glass accounts without monitoring, or legacy apps left on the VPN indefinitely.
- Policies without device signals: MFA alone does not stop sign-in from an infected, unmanaged laptop.
- Ignoring service accounts and admin paths, which attackers use for lateral movement.
- Forgetting the people: clear communication and security awareness training reduce pushback and MFA fatigue.
Contact us if you would like a zero trust gap analysis mapped to the NCSC principles and the licences you already hold.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is zero trust security in simple terms?
Zero trust means never trusting a user, device or network just because of where it is. Every request is checked for identity, device health and context, given only the access it needs, and monitored. The phrase often used is 'never trust, always verify'.
What are the pillars of zero trust?
The CISA Zero Trust Maturity Model uses five pillars: identity, devices, networks, applications and workloads, and data, with visibility and analytics, automation and orchestration, and governance running across all of them.
Is zero trust the same as ZTNA?
No. Zero trust is the overall security strategy. ZTNA (zero trust network access) is one technology within it that gives users access to specific private applications instead of the whole network, typically replacing a VPN.
Can small businesses adopt zero trust?
Yes. The first stages, which are MFA everywhere, managed and healthy devices, conditional access and removing standing admin rights, are achievable with licences many small businesses already hold, such as Microsoft 365 Business Premium.
How long does a zero trust roadmap take?
It is a programme rather than a project. Strong identity and device controls can be in place within weeks; replacing a VPN, segmenting the network and protecting data usually follow over several months, prioritised by risk.