What Is Zero Trust? A Plain-English Guide for Australian Businesses

Zero trust is a security model built on a simple rule: never trust, always verify. Instead of assuming anyone inside the network is safe, zero trust treats every user, device, and connection as untrusted until it is verified, and grants only the minimum access needed. For Australian businesses, it is the shift away from the old "hard shell, soft centre" network towards checking identity and context on every request.

Key facts

• Zero trust operates on three principles: verify explicitly, use least privilege, and assume breach.
• It replaces the old perimeter model where anyone inside the network was trusted by default.
• The term was coined by analyst John Kindervag in 2010 while at Forrester Research.
• Zero trust is an architecture and a strategy, not a single product you buy.
• Zero trust network access (ZTNA) is the specific technology that applies zero trust to remote access, replacing traditional VPNs.
• It directly supports the access-control and privilege-restriction goals of the ACSC Essential Eight.

What does zero trust actually mean?

Zero trust means no user or device is trusted automatically, even if it is already inside the corporate network. The old way of thinking treated the network like a castle: build a strong wall (the firewall), and once someone is inside, let them move around freely. The problem is obvious once you say it out loud. If an attacker gets past the wall, whether through a stolen password, a phishing email, or an infected laptop, they have the run of the place.

Zero trust throws out the idea of a trusted inside. Every request to reach a resource is checked: who is this user, is their device healthy, are they allowed to reach this specific thing, right now? Trust is never assumed based on network location. It is earned, per request, every time.

What are the three principles of zero trust?

Zero trust rests on three principles: verify explicitly, use least privilege, and assume breach. These come up in every serious framework, including the guidance from the US National Institute of Standards and Technology (NIST) that most models draw from.

Verify explicitly means authenticating and authorising every request using all available signals, identity, device health, location, and risk, rather than trusting a connection because of where it came from. Use least privilege means giving each user and device the minimum access they need to do their job, and no more, so a compromised account is limited in what it can reach. Assume breach means designing the network as though an attacker is already inside, segmenting access and logging everything so that a single compromised account cannot cascade into a full breach.

How is zero trust different from a traditional VPN or firewall?

A traditional firewall and VPN protect the perimeter and then trust everything inside, while zero trust verifies every connection regardless of location. With a VPN, once a user connects, their device is on the network and can typically reach far more than it needs. Zero trust, applied to remote access through zero trust network access (ZTNA), connects a user only to the specific application they are entitled to, and checks identity and device health first. The firewall still has a role, but it is no longer the only thing standing between an attacker and your data.

Is zero trust worth it for a small business?

Zero trust is worth adopting for any business with remote staff, cloud services, or sensitive data, and you do not have to do it all at once. The mistake people make is treating zero trust as an expensive, all-or-nothing enterprise project. In practice it is a direction of travel: enable multi-factor authentication, tie access to identity, segment your network, apply least privilege, and adopt ZTNA when you replace your VPN. Each step reduces risk on its own. For a Sydney SME, the most valuable early moves are usually MFA everywhere and getting off a flat network where every device can see every other device.

Frequently asked questions

Who invented zero trust?

The term "zero trust" was coined by John Kindervag in 2010 while he was an analyst at Forrester Research. The underlying ideas built on earlier work, and the model has since been formalised by bodies like the US National Institute of Standards and Technology (NIST) in its Special Publication 800-207.

Is zero trust a product I can buy?

No. Zero trust is a security model and strategy, not a single product. You implement it using a combination of tools, identity and access management, multi-factor authentication, device management, network segmentation, and zero trust network access, along with policies. Vendors sell products that help you achieve zero trust, but no single purchase makes you "zero trust".

What is the difference between zero trust and ZTNA?

Zero trust is the overall security model; zero trust network access (ZTNA) is a specific technology that applies zero trust principles to remote access. ZTNA is what replaces a traditional VPN, connecting users to individual applications based on verified identity rather than putting them on the whole network. ZTNA is one part of a broader zero trust strategy.

Does zero trust help with Australian compliance?

Yes. Zero trust directly supports several goals of the ACSC Essential Eight, particularly restricting administrative privileges and limiting how far a compromised account can reach. It also helps demonstrate the reasonable security steps expected under the Privacy Act 1988 and the Notifiable Data Breaches scheme, because access is verified, segmented, and logged.

If you are wondering where your business actually stands against a zero trust approach, or just want a sensible first step that is not an enterprise-scale project, we are happy to talk it through. Give us a call on 1800 367 448.