What is BeyondCorp and how does it differ from zero trust?

BeyondCorp is the name of Google's internal security model that removed the privileged corporate network and moved employee applications to the internet, with access decided per user and device. It was an early, real deployment of ideas that NIST later described as zero trust architecture.

What problem did BeyondCorp set out to solve?

Google's research paper, BeyondCorp: A New Approach to Enterprise Security, opens with the problem. Almost every company uses firewalls to enforce a perimeter, but this model is problematic because once the perimeter is breached, an attacker has relatively easy access to the privileged intranet. As companies adopt mobile and cloud technologies, the perimeter gets harder to enforce.

The paper's answer is to remove the requirement for a privileged intranet and move the corporate applications to the internet. In other words, sitting on the office network stops being a reason to trust a request.

How does that line up with zero trust?

NIST SP 800-207 defines zero trust as a set of approaches that move defenses from static network perimeters to users, assets and resources. Its core ideas include:

• No implicit trust granted to an asset or account because of its network location or ownership.
• Authentication and authorization of the user and the device as discrete functions, done before a session to a resource starts.
• Protection centered on resources such as services and workflows, not network segments.

BeyondCorp is one concrete case of this. The abstract of NIST's document names the same drivers: remote work, personal devices and cloud assets outside enterprise networks.

What is the difference, then?

BeyondCorp is a specific implementation built around Google's own systems and history. Zero trust, as NIST uses the term, is a general architecture with deployment models that organizations adapt. You can follow zero trust without copying BeyondCorp, and you cannot buy BeyondCorp by buying any one product.

A useful way to hold it in your head:

1. Zero trust is the principle: decide access per request, based on identity, device state and context.
2. BeyondCorp is one organization's journey toward it, with the intranet removed.
3. Your version will be a series of smaller steps.

What would a first step look like?

A constructed example: a 400-person company has a VPN that gives staff a route to every internal app. Anyone who steals a laptop and a password has the whole network. The company picks its three most sensitive apps, puts each behind an identity-aware proxy that checks the user's login and whether the laptop is managed and encrypted, and then removes VPN access to those three apps. Everything else keeps using the VPN for now. Within a quarter, the most valuable systems no longer depend on network location, and the team has a pattern to repeat.

What should you watch out for?

• A device check is only as good as your device inventory. Unmanaged devices need a clear rule.
• Access decisions need good identity data. Stale groups and shared accounts weaken them.
• Moving apps to the internet raises the stakes on each app's own security, so patching and authentication matter more.
• You still need segmentation and logging inside your cloud and data centers.

How to check or apply this

1. List the ten most sensitive internal applications and how staff reach them today.
2. For each, write down what grants access: network location, VPN, a login, or a login plus device state.
3. Pick one app and place it behind per-request checks of user and device.
4. Define what makes a device acceptable: managed, encrypted, patched, screen lock on.
5. Log every access decision, including denials, and review the denials weekly for the first month.
6. Remove the old network path to that app once the new one works.

Quick check

Sources

• Google Research, BeyondCorp: A New Approach to Enterprise Security
• NIST SP 800-207, Zero Trust Architecture

Last reviewed: 18 October 2026.