What security model came before zero trust?

Before zero trust, most organisations used a perimeter model, sometimes called castle and moat. Defences sat at the network edge, and devices and users inside the boundary were trusted by default. Zero trust drops that implicit trust and checks each request, no matter where it comes from.

What was the perimeter model?

Picture an office network in the early 2000s. Staff sit in one building, servers sit in a back room, and a firewall stands between the company and the internet. The rule is simple: traffic from outside is suspect, traffic from inside is fine.

NIST SP 800-207, the zero trust architecture standard, describes the shift away from this as moving defences from static, network-based perimeters to a focus on users, assets and resources. The phrase "static, network-based perimeters" is the old model in four words.

Why did it work for a while?

Because the assumptions matched reality. Applications ran in company data centers. Employees used company machines on company premises. A single choke point made monitoring practical, and a firewall at that point (NIST SP 800-41 covers firewall types and policy) gave a clear place to apply rules.

What made it fail?

NIST names the drivers directly: remote users, bring your own device, and cloud-based assets that are not located within an enterprise-owned network boundary. Each one moved something outside the wall.

A second problem was what happens after a breach. A phishing email lands a foothold on one laptop. Inside a flat, trusted network, that foothold can reach file servers, databases and admin tools. The perimeter did nothing, because the attacker was already inside, and internal traffic was not checked.

A constructed example: a contractor's laptop joins the VPN. The VPN gives it an address on the internal network, and internal address ranges are allowed everywhere. The laptop carries malware. From the network's point of view it is as trusted as the finance director's machine.

What changed with zero trust?

SP 800-207 states that zero trust assumes no implicit trust is granted to assets or accounts based only on physical or network location, or on asset ownership. Authentication and authorisation, of both the user and the device, happen before a session to a resource starts. The protection target becomes the resource: an application, a service, a data store. Not the network segment.

CISA's Zero Trust Maturity Model describes the goal as enforcing accurate, least privilege, per-request access decisions in the face of a network viewed as compromised. It treats zero trust as a shift from a location-centric approach to a data-centric one, and adds that it may require a change in an organisation's culture as well as its tools.

Did the perimeter disappear?

No. Firewalls and segmentation remain useful, and NIST SP 800-215 treats traditional network security appliances alongside newer access models. What changed is the role of the edge. It is one control among many, not the place where trust is decided.

What replaced the old habits in daily work?

Think about what changes for an ordinary employee. Under the old model, joining the office network or the VPN was the event that granted access, and it lasted all day. Under a zero trust approach, access is decided again for each application and can be revisited during the session if the device falls out of compliance. For the user this often looks like a more frequent sign-in prompt. For the security team it looks like a log entry per decision, which is far more useful in an investigation than a record that someone connected to a VPN at nine.

How to check or apply this

1. Ask where in your environment "inside the network" still grants access on its own. Write the list.
2. Pick one high-value application and require authenticated, device-aware access to it regardless of network location.
3. Remove broad internal allow rules between server groups that do not need to talk.
4. Turn on multifactor authentication for all remote and administrative access.
5. Log access decisions per application so you can see who reached what.
6. Treat the move as a programme of small steps. CISA's maturity model gives a staged path.

Quick check

Sources

• NIST SP 800-207, Zero Trust Architecture
• CISA, Zero Trust Maturity Model
• NIST SP 800-215, Guide to a Secure Enterprise Network
• NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy

Last reviewed: 18 October 2026.