Extending zero trust to the endpoint means a device earns access per request, based on checks of its identity and condition, instead of being trusted because it sits on the corporate network or is company owned. The access decision looks at the user and the device together, before each session to a resource.
What does NIST say zero trust is?
NIST SP 800-207 describes zero trust as an evolving set of paradigms that move defenses from static, network based perimeters to a focus on users, assets and resources. Its central statement is that no implicit trust is granted to assets or accounts based solely on physical or network location, or on asset ownership, whether enterprise or personally owned. Authentication and authorization, for both subject and device, are discrete functions performed before a session to an enterprise resource is established.
That sentence is the endpoint requirement. A laptop in the office is not trusted because it is in the office. A company issued laptop is not trusted because the company bought it.
Why is the endpoint the hard part?
The document names the trends behind zero trust: remote users, bring your own device and cloud based assets outside any enterprise owned network boundary. All three put the device outside your control, where it may be unpatched, shared, lost, or carrying malware. A strong user login on a compromised device still hands the attacker a valid session.
CISA's Zero Trust Maturity Model, version 2.0, organizes the work into five pillars and three cross-cutting capabilities, and for each pillar gives examples of traditional, initial, advanced and optimal architectures. The model is one of many roadmaps agencies may use, and CISA notes zero trust may require a change in an organization's philosophy and culture around cybersecurity. The device pillar is where endpoint posture lives.
What does an endpoint check actually look like?
A posture check asks questions at the moment of access. Is this device known and enrolled? Is it running a supported operating system with current patches? Is disk encryption on? Is a protection agent running and healthy? Is the user session bound to this device? The answers feed a policy that grants, limits or denies access, and the policy engine decides per resource, so a device that passes for email might fail for the finance system.
A constructed example
A company allows contractors to use their own laptops for a project tracker and a source repository. Under the old model, a VPN login granted both. Under the new one, the tracker accepts any device with a current browser and MFA. The repository requires an enrolled device with disk encryption and a current patch level, and read only access if the device is unmanaged. A contractor's laptop that misses a patch for three weeks loses repository access automatically, with a message explaining why, and regains it after updating. Nobody had to investigate anything.
How to check or apply this
- Inventory endpoints, including personal devices that touch company data, by owner and by operating system.
- Define the minimum posture for each class of resource: patched, encrypted, enrolled, protected.
- Enforce posture at access time, not only at enrollment, and re-evaluate during long sessions.
- Bind sessions to the device where your tools allow, so a stolen token is harder to reuse elsewhere.
- Give unmanaged devices a reduced path, such as browser only and no downloads.
- Treat developer machines as high value: they hold source code, tokens and signing keys.
- Use a maturity model such as CISA's to set stages, and measure progress per pillar.
- Plan for failure: define what happens when the posture service is down.
Safeguard works on the code and dependency side of this problem, and does not replace endpoint management or protection tools.
Quick check
Does zero trust mean a device is never trusted?
It means trust is never implicit. A device can be granted access for a resource when checks pass at the time, and that decision is revisited.
Are personally owned devices ruled out?
No. NIST SP 800-207 explicitly covers personally owned assets. The access decision depends on device condition, not on who owns it.
Sources
Last reviewed: 18 October 2026.
