The Five Pillars of Zero Trust Security (and Why Each Matters)

At A Glance

Zero Trust Security is a cybersecurity framework built on one principle: never trust, always verify. Unlike traditional security models that assumed anything inside the network was safe, Zero Trust treats every access request from any user, device, or application, inside or outside the organization as potentially compromised until proven otherwise. It achieves this through five core pillars: Identity Verification, Device Trust, Microsegmentation, Least Privilege Access, and Data Protection and Encryption. Together, these pillars remove implicit trust from the network and replace it with continuous, policy-driven verification.

Why Perimeter Security No Longer Works

For decades, network security operated like a castle and moat: build a strong wall, guard the gate, and trust everyone inside. That model has collapsed.

The modern enterprise has no single perimeter; employees work remotely, applications live in the cloud, partners and vendors connect to internal systems, and devices proliferate far beyond what any IT team can track. Likewise, attackers have learned that the most reliable way into an organization isn’t to storm the gate; it’s to obtain valid credentials, walk in through the front door, and move quietly through a network that trusted them the moment they arrived.

This is the core failure that Zero Trust was designed to correct. It doesn’t assume the perimeter held; It assumes the attacker is already inside, and builds security that works from that starting point.

What Is Zero Trust Security?

Zero Trust Security is a cybersecurity framework that eliminates implicit trust from the network. Every access request, regardless of where it originates or who is making it, must be authenticated, authorized, and continuously validated before access is granted. Even if an attacker obtains a username and password, Zero Trust limits what they can access, where they can go, and how long they can operate before being detected.

The term was coined by analyst John Kindervag at Forrester in 2010, but adoption accelerated sharply after high-profile breaches made clear that perimeter defenses alone couldn’t stop determined attackers with valid credentials. Today, Zero Trust is recognized by NIST (SP 800-207), CISA, and the U.S. federal government as the standard architecture for modern cybersecurity.

Key Takeaway: Zero Trust doesn’t make your network impenetrable, but it makes a breach far less damaging by ensuring that no single compromised credential unlocks the kingdom.

The 5 Pillars of Zero Trust Security

Zero Trust architecture is structured around five interconnected pillars. No single pillar works in isolation; the strength of the model comes from applying all five together.

1. Identity Verification
2. Device Trust
3. Microsegmentation
4. Least Privilege Access
5. Data Protection and Encryption

Pillar 1: Identity Verification

Identity is the new perimeter. In a Zero Trust model, the question isn’t “is this request coming from inside the network?” It’s “can we verify exactly who or what is making this request, right now?”

This requires more than a password. Strong Zero Trust identity practices include:

• Multi-Factor Authentication (MFA) — specifically phishing-resistant MFA, such as hardware security keys or passkeys, not SMS codes that can be intercepted
• Centralized identity management — a single authoritative source of truth for user and machine identities across the organization
• Continuous authentication — session trust isn’t granted once at login; it’s re-evaluated based on behavior, location, device health, and risk signals throughout the session
• Machine identity — in modern environments, it’s not just humans who need identities. Applications, services, APIs, and IoT devices all require verifiable identities with the same rigor applied to human users

The CISA Zero Trust Maturity Model lists identity verification as the first and most foundational pillar, because if you can’t verify who’s asking, nothing else in the architecture can function correctly.

Pillar 2: Device Trust

Identity verification tells you who is asking. Device trust tells you what is asking — and whether that device should be trusted at this moment.

A valid set of credentials on a compromised, unpatched, or jailbroken device is a security risk. Zero Trust treats every device as a potential attack vector until it passes a health check.

Device trust typically involves:

• Continuous device health assessment — checking OS patch level, security configuration, endpoint detection and response (EDR) status, and whether the device meets organizational security baselines before granting access
• Device inventory and visibility — you cannot trust what you cannot see. A complete, real-time asset inventory is a prerequisite (CISA’s Continuous Diagnostics and Mitigation (CDM) program provides a federal framework for this)
• Posture-based access decisions — access grants are conditioned on device health, not just identity; a device that fails its health check gets no access or limited access until remediated

In IIoT and operational technology environments, device trust becomes even more complex: industrial sensors, controllers, and edge devices often can’t run traditional endpoint agents. Zero Trust architectures for these environments rely on network-level enforcement and hardware-rooted identity to extend device trust to constrained devices.

Pillar 3: Microsegmentation

Even with strong identity and device controls, breaches happen. Microsegmentation is what limits the damage when they do.

Traditional networks are “flat”: once inside, an attacker can move laterally across systems with little resistance. The 2020 SolarWinds breach is a stark example: attackers with valid credentials moved quietly through interconnected systems for months before detection.

Microsegmentation divides the network into small, isolated zones. Each zone has its own access policy, and crossing zone boundaries requires fresh verification. An attacker who compromises one zone finds their path blocked at every boundary.

In practice, microsegmentation means:

• Workloads, applications, and data sets are isolated from each other. Development and production environments don’t share a blast radius
• East-west traffic (internal, server-to-server) is inspected and policy-controlled, not just north-south traffic at the perimeter
• Policy enforcement is software-defined. Segmentation follows the workload, not the physical network topology

For software-defined approaches like the NetFoundry platform, microsegmentation is achieved through application-embedded Zero Trust: connectivity is brokered at the application level, and workloads that aren’t supposed to communicate are simply invisible to each other, not just blocked.

Pillar 4: Least Privilege Access

“Least privilege” means users, applications, and systems are granted only the permissions they need to perform their specific function — nothing more, and nothing longer than necessary.

This pillar directly limits the blast radius of any compromised account or credential. An attacker who obtains credentials for a customer support agent should not be able to access financial systems, source code repositories, or infrastructure controls. Least privilege ensures they can’t.

Implementing least privilege effectively requires:

• Role-based access control (RBAC) — access rights are assigned to roles, not individuals, and roles are scoped to job function
• Just-in-time (JIT) access — elevated permissions are granted for specific tasks and time windows, then automatically revoked; no standing privileged access
• Regular access reviews — permissions accumulate over time; periodic audits ensure no account holds more access than its current role requires
• Application-level enforcement — in embedded Zero Trust environments, least privilege is enforced at the network layer: services are only reachable by the identities explicitly permitted to reach them

Pillar 5: Data Protection and Encryption

The final pillar protects data itself, ensuring that even if an attacker bypasses the other four pillars, the data they reach is unreadable and unusable. In a Zero Trust architecture, encryption is not optional or perimeter-limited; it’s end-to-end and continuous:

• Data in transit is encrypted between every endpoint. Not just at the network edge, but between services, devices, and cloud environments
• Data at rest is encrypted with access controls tied to identity and role. Storage isn’t accessible by default; it requires active authorization
• End-to-end encryption (E2EE) ensures that intermediary systems, including network infrastructure and cloud providers, can’t decrypt data in transit; only the authorized sender and receiver hold the keys

End-to-end encryption is particularly critical in multi-cloud and hybrid environments, where data traverses infrastructure operated by multiple parties. Zero Trust principles require that encryption be enforced regardless of where the data is or who operates the underlying infrastructure.

What Zero Trust Security Delivers: Key Benefits

Organizations that implement Zero Trust consistently report benefits across security, operations, and compliance.

• Reduced breach impact. Segmentation and least privilege means an attacker with valid credentials can only reach a fraction of what they could in a flat network. The lateral movement that defines major breaches becomes dramatically harder.
• Improved regulatory compliance. Zero Trust’s strict access controls and audit trails directly support requirements under HIPAA, PCI-DSS, SOC 2, CMMC, and other frameworks. Many auditors now treat Zero Trust adoption as evidence of mature security practices.
• Greater visibility. Continuous monitoring and logging of all access requests gives security teams a real-time view of what’s happening everywhere in the network.
• Cloud and hybrid readiness. Zero Trust architectures don’t depend on a fixed perimeter, making them naturally suited to multi-cloud, hybrid, and distributed environments where traditional VPN-based security breaks down.
• Reduced insider threat exposure. By verifying continuously rather than trusting sessions established at login, Zero Trust catches anomalous behavior — whether from a compromised account or a malicious insider — faster than perimeter-only models.

Implementing Zero Trust: Where to Start

Zero Trust is a journey, not a product you buy and deploy. Organizations that succeed treat it as a phased transformation rather than a one-time project.

1. Define your protection surface. Identify the data, applications, assets, and services that are most critical to protect.
2. Map how traffic flows. Understand how users and systems interact with your most critical resources today. This reveals where implicit trust lives so you can replace it with explicit verification.
3. Build access policies around identity and context. Move from network-based access (“this IP is allowed”) to identity-based access (“this verified identity, on a healthy device, in this context, may access this resource”).
4. Segment progressively. You don’t need to microsegment everything on day one. Start with your most critical workloads and expand the segmentation boundary over time.
5. Automate enforcement and response. Manual policy enforcement doesn’t scale. Zero Trust requires security orchestration and automation tools (SOAR) to detect anomalies and respond in real time.
6. Invest in continuous monitoring. Zero Trust requires visibility into all traffic, all access events, and all device health signals continuously, not periodically.

Zero Trust in Practice: the NetFoundry Platform

Understanding Zero Trust conceptually is one thing, but implementing it — especially for machine-to-machine connectivity, APIs, and distributed systems — requires infrastructure built for it from the ground up.

OpenZiti is an open-source Zero Trust networking framework that embeds Zero Trust directly into applications and services. Rather than relying on network-level controls that can be bypassed, OpenZiti makes connectivity identity-driven at the application layer: services are only reachable by identities that have been explicitly provisioned to reach them. With no open inbound ports and no VPN, the attack surface is reduced to near-zero by design.

NetFoundry is the original creator of OpenZiti and its primary commercial contributor. The NetFoundry platform builds on OpenZiti to deliver Identity-First Reachability™ as a service — Zero Trust networking for machines, APIs, AI agents, and distributed workloads, without requiring firewall changes or custom hardware.

Where traditional ZTNA focuses on securing human user access, NetFoundry focuses on the machine-to-machine connectivity layer: the APIs, services, and workloads that make up modern enterprise infrastructure — and that are increasingly targeted because they lack the identity and access controls applied to human users.

Frequently Asked Questions

About NetFoundry

NetFoundry is the creator of OpenZiti, the leading open-source Zero Trust networking framework, and the developer of the NetFoundry Platform — Identity-First Reachability™ as a service. NetFoundry enables organizations to connect machines, APIs, AI agents, and distributed workloads with Zero Trust security built in from the start: no VPNs, no open inbound ports, no firewall rule changes. Headquartered in Charlotte, NC, NetFoundry serves enterprise customers across software, IIoT, and service provider verticals.