What is Zero Trust Security: Implementation

Key Takeaways:

• Zero trust is a $32 billion market with 63% of organizations implementing it to some degree, according to Forrester’s John Kindervag, the model’s creator.
• NIST SP 800-207 defines seven tenets and three core components: the policy engine (PE), policy administrator (PA), and policy enforcement point (PEP).
• The NSA’s 2026 Zero Trust Implementation Guidelines break the journey into Discovery, Phase One (36 activities), and Phase Two (41 activities).
• Micro-segmentation is the foundation, but identity alone is not enough, it must be combined with device posture and contextual signals.
• Zero trust is a process, not a product. Any vendor claiming to sell a “zero trust product” is misrepresenting the model.

The Perimeter Is Dead: Why Zero Trust Moved From Buzzword to Mandate

Stolen credentials accounted for 22% of known initial access vectors in 2025, making them the single most common way attackers breach a network, according to Verizon’s Data Breach Investigations Report. Once inside, excessive permissions and limited visibility let attackers escalate unchecked. This is the failure that Zero Trust Architecture exists to fix, and it is why the model has stopped being optional.

The numbers tell a clear story. John Kindervag, who introduced the Zero Trust model in a Forrester research article nearly 14 years ago, now writes that it has become a $32 billion market, with 63% of organizations globally implementing the strategy to some extent. The catalyst was not theoretical. Google’s BeyondCorp initiative was born directly from Operation Aurora, the 2009 cyber-espionage campaign that breached the corporate network from inside the “trusted” zone. That breach forced Google’s security team to conclude that network location could no longer determine access privileges, a conclusion now codified in federal mandate.

This post builds on our earlier primer on Zero Trust principles, but goes deeper into the mechanics that decide whether an implementation ships or stalls: the exact components, the phased roadmap that the NSA and NIST have formalized since that primer was published, and a vendor comparison grounded in what each platform actually does.

Zero Trust Principles: The Seven Tenets That Define the Model

NIST Special Publication 800-207, published in August 2020, is the authoritative definition of the architecture. It describes seven tenets, and they are worth reading as a checklist rather than a philosophy. The CSO Online breakdown of the seven tenets is the clearest plain-English version.

The first tenet is that all data sources and computing services are considered resources. This means endpoints and servers are no longer the only things you defend; function-as-a-service, containers, and cloud workloads all count, and all need authentication and least-permissive access controls. The second is that all communication is secured regardless of network location, which is where zero trust network access (ZTNA) replaces the VPN. In a ZTNA environment, the policy is default-deny, and users cannot even see applications they have not been explicitly granted access to.

The remaining tenets are where most implementations fail. Access is granted on a per-session basis, meaning trust does not carry over from a previous session. Access is determined by dynamic policy, including the observable state of client identity, application, and the requesting asset, plus behavioral and environmental attributes. The enterprise monitors the integrity and security posture of all owned and associated assets. All authentication and authorization are dynamic and strictly enforced before access is allowed. And finally, the enterprise collects as much information as possible about the current state of assets and uses it to improve posture.

Kindervag’s recurring warning is that identity is not the whole answer. “Identity as sole decision point doesn’t work,” he writes. It is merely a signal indicating the attributes of the device accessing the system. He points to the Snowden and Manning cases, both trusted insiders with valid credentials, as proof that continuous monitoring and contextual analysis must sit alongside identity verification. A solid implementation combines identity with time of day, device type, posture checks, and risk assessments.

The Core Components: PE, PA, and PEP

Every Zero Trust Architecture, regardless of vendor, reduces to three components that NIST names explicitly: the policy engine (PE), the policy administrator (PA), and the policy enforcement point (PEP). Understanding these three is the difference between buying a tool and building an architecture.

The policy engine is the brain. It makes the ultimate decision to grant, deny, or revoke access based on enterprise policy and input from external sources like threat intelligence and identity systems. The policy administrator is the mechanism that establishes or shuts down the communication path between a subject and a resource, generating the session-specific authentication tokens or credentials that the client uses. The policy enforcement point is the gate itself: it enables, monitors, and ultimately terminates connections between a subject and an enterprise resource, sitting in front of each resource so that every request passes through it.

The decision loop matters because it never stops. In a traditional perimeter model, a user authenticates once at the VPN and then moves laterally with implicit trust. In this model, every session, every request, and every resource transition triggers a fresh evaluation. The policy engine feeds telemetry back into analytics, which updates risk signals, which feed the next decision. This is why practitioners describe zero trust as a continuous cycle rather than a state you reach.

The practical consequence is a shift in how security operations teams work. Jerry Chapman, co-chair of the Cloud Security Alliance’s Zero Trust Working Group, described the effect on the SOC: default-deny “significantly improves signal to noise ratio.” Everything that happens is either allowed by policy and can be analyzed more deeply, or it is disallowed and can be reviewed for attempted access. That is a meaningfully different operating posture from a SOC drowning in perimeter noise.

Micro-Segmentation: Identity-Centric Containment

Micro-segmentation is the foundation of zero trust, according to Kindervag, and it is the mechanism that actually contains a breach. It divides the network into small, isolated segments, each with its own access controls and security policies, limiting lateral movement and reducing the attack surface. The Infosecurity Magazine analysis of microsegmentation describes it as the technique that lets organizations apply granular policies based on user identity, device posture, and application context rather than IP address.

The benefits are concrete. Segmentation reduces the attack surface because a compromised segment cannot be used as a pivot point. It enables granular access controls tied to identity and device health. It provides visibility into traffic patterns and application dependencies that most organizations simply do not have. And it supports compliance by enforcing separation of duties and least-privilege access at the network layer, which maps directly to requirements across GDPR, SOC 2, and HIPAA.

The challenges are equally concrete and often underestimated. Modern network architectures contain diverse devices, applications, and infrastructure components, and mapping their interactions is a prerequisite for defining segments. Policy definition demands precision: access controls must be specified per segment based on user roles, device types, and application dependencies. Dynamic workloads in cloud environments make static policies obsolete quickly. And microsegmentation adds processing overhead that must be evaluated against performance impact.

The most common failure is treating segmentation as a network project rather than an identity project. Segmentation that keys off IP addresses collapses the moment a workload moves to a new subnet or a container reschedules. Identity-centric segmentation, where policy follows the workload’s cryptographic identity rather than its network location, is what survives in cloud-native environments. This is why the NSA’s guidance and the vendor roadmaps both emphasize workload identity as a distinct control from network segmentation.

Implementation Phases: From Discovery to Advanced Maturity

The most significant development since NIST’s 2020 conceptual document is the formalization of a phased implementation roadmap. In June 2025, NIST’s National Cybersecurity Center of Excellence (NCCoE) published practical guidance with 19 example implementations built from commercial off-the-shelf technology, developed over four years with 24 industry collaborators. Alper Kerman, the NIST computer scientist who co-authored the guidance, framed the core challenge plainly: “Switching from traditional protection to zero trust requires a lot of changes. You have to understand who’s accessing what resources and why. Also, everyone’s network environments are different, so every ZTA is a custom build.”

The NSA went further, releasing its Zero Trust Implementation Guidelines (ZIGs) in early 2026. These build on the 2024 DoD Zero Trust Overlays, which specified 152 activities in the zero trust journey (91 for target-level maturity, 61 for advanced-level maturity). The ZIGs refine the target-level activities into three phases, as detailed by FedTech Magazine: Discovery, Phase One, and Phase Two, with two additional phases for advanced maturity still to come.

Discovery is the starting point, and it is non-negotiable. You cannot secure what you cannot see. This phase means building a definitive inventory of users, devices, applications, and data flows. Russ Smith, field CTO for Zscaler, described the logic: “You’ve got to know your security environment first before beginning your zero-trust journey.”

Phase One builds the foundation, incorporating 36 activities and 30 capabilities. This is where identity and device posture become the primary perimeter, where phishing-resistant MFA is deployed, and where the first protect surfaces are segmented. Phase Two adds 41 activities and 34 capabilities, expanding coverage as budget and schedule allow. The NSA emphasizes modularity throughout, recognizing that every organization sits at a different maturity level across its IT landscape.

The implementation sequence that practitioners converge on is consistent across NIST, NSA, and the vendor ecosystem. Start with asset and identity inventory, because it is the foundation everything else depends on. Deploy phishing-resistant MFA immediately, as it is the single highest-impact control and blocks the overwhelming majority of automated credential attacks. Identify one protect surface, typically the smallest and most critical one, and map its data flows. Then segment it, apply policy, and monitor before expanding to the next surface. Kindervag’s advice is to focus on “small, manageable areas known as Protect Surfaces,” starting with the most critical parts of the network, rather than attempting a rip-and-replace.

Vendor Comparison: SASE, ZTNA, and Segmentation

Zero trust is not a product, but specific products implement its control layers. The vendor landscape divides into two overlapping families that the FedTech SSE vs. SASE guide clarifies. Security Service Edge (SSE) delivers cloud-based security services: secure web gateway (SWG), cloud access security broker (CASB), and zero trust network access (ZTNA). Secure Access Service Edge (SASE) adds networking, most notably SD-WAN, on top of SSE. Joseph Welsh, vice president of U.S. public sector at Netskope, described SSE as “the security heart of SASE,” and recommended SSE as “often the fastest and least disruptive path for agencies modernizing toward zero trust.”

Micro-segmentation is a separate control layer, and the market is consolidating around partnerships rather than single vendors. Illumio, a zero-trust segmentation company, and Netskope, a SASE provider, announced a strategic partnership to integrate their segmentation and ZTNA capabilities. Akamai’s Guardicore Segmentation platform has added AI-powered policy enforcement for hybrid and multi-cloud environments. These pairings reflect a structural truth: no single vendor owns the full zero trust stack.

The table below compares the key components and what each platform family actually delivers, drawn from the vendor announcements and guidance above. Treat it as a planning map, not a scorecard, since capabilities shift quarterly.

The trade-off embedded in this table is the one most buyers miss. SASE and SSE vendors excel at the access layer, securing the path between user and application. Segmentation vendors excel at the containment layer, stopping lateral movement once a workload is compromised. A mature architecture needs both, which is exactly why the Illumio-Netskope and Akamai-Kyndryl partnerships exist. Buying a single vendor’s “zero trust suite” and calling the job done is the most common procurement error in this space.

Common Pitfalls and Enforcement Trends

The enforcement landscape is moving faster than most organizations’ roadmaps. Senator Ron Wyden has proposed a two-year federal deadline to purge every legacy VPN appliance accessible from the public internet, a procurement rule that would reshape the vendor market by forcing agencies off VPN-dependent access models. CISA has separately published guidance to help agencies replace legacy internet gateways with SASE under TIC 3.0. The direction is unambiguous: the perimeter model is being retired by regulation, not just by best practice.

The pitfalls are well documented and repeatable. The first is treating zero trust as a product purchase. Kindervag is blunt: “Any business or vendor that claims to have a zero trust product is either lying or doesn’t understand the concept at all.” The second is over-rotating on identity while ignoring device posture and context, which leaves the Snowden-Manning insider-threat gap wide open. The third is attempting a rip-and-replace overhaul instead of an incremental, protect-surface-by-protect-surface approach. The fourth is skipping discovery, which produces segmentation policies built on an incomplete inventory that collapse the moment an unmapped workload appears.

Travis Rosiek, public sector CTO for Rubrik, added a warning specific to the current moment: “Many agencies will try to use what resources they currently have to align with zero trust. But that approach does not uplift security posture in any way. In many cases, adversaries already have a foothold in their systems.” The point is that zero trust is not a re-labeling exercise. It requires disrupting the existing environment, not maintaining the status quo with a new marketing term.

There is also an emerging AI dimension. Both Kindervag and the federal guidance note that AI-assisted attacks will outpace organizations’ ability to defend against them, and zero trust’s dynamic, context-aware enforcement is precisely what mitigates the volume and velocity of those attacks. The vendors are responding: Zscaler’s ZAgent Framework and Versa’s zero-trust architecture for the Model Context Protocol both extend zero trust controls to AI agents, treating them as new classes of subjects that must be authenticated, authorized, and continuously verified like any other workload.

Key Takeaways

• Zero trust has moved from concept to mandate: a $32 billion market with 63% of organizations implementing it, driven by federal deadlines and the collapse of the perimeter model.
• The architecture reduces to three components, PE, PA, and PEP, wired into a continuous decision loop that never grants implicit trust.
• Micro-segmentation is the foundation, but it must be identity-centric and workload-aware to survive cloud-native environments.
• The NSA’s 2026 guidance formalizes the roadmap: Discovery, then Phase One (36 activities), then Phase Two (41 activities), with modularity built in.
• No single vendor owns the stack. SASE/SSE handles access, segmentation vendors handle containment, and a mature deployment needs both.
• Zero trust is a process, not a product, and the most common failure is treating it as a one-time purchase rather than an ongoing journey.

For further reading on adjacent controls, see our coverage of phishing-resistant MFA, which is the first control every zero trust roadmap should deploy, and Cloud Security Posture Management, which closes the misconfiguration gap that zero trust’s access controls assume is already handled.

Related Reading

More in-depth coverage from this blog on closely related topics:

• Data Retention Rules: How to Manage Data
• What is Multi-Factor Authentication

Sources and References

Sources cited while researching and writing this article:

• according to Verizon’s Data Breach Investigations Report
• $32 billion market
• 7 tenets of zero trust explained
• The Role of Microsegmentation in Strengthening Zero Trust Security
• NIST Publishes New Zero Trust Implementation Guidance
• Zero-Trust Implementation: Understanding NSA’s Phase One and Phase Two Guidance
• SSE vs. SASE: Federal Agencies’ Guide to Cloud Security Architecture
• Zscaler unveils ZAgent Framework to automate zero-trust SASE operations
• How Illumio microsegmentation and Netskope ZTNA integration ‘gets zero trust covered’
• Akamai updates Guardicore Segmentation with AI to automate zero-trust policy enforcement