Zero trust is a set of concepts for making access decisions per request, not a product you buy. NIST SP 800-207 also says migration is gradual and that no network location is trusted by default. Here are five common myths set against the text.
Myth 1: Zero trust is a product
Fact: NIST's glossary defines it as a collection of concepts and ideas designed to minimize uncertainty in enforcing least privilege per request decisions, treating the network as potentially compromised. An architecture can be assembled from several components. A vendor can help you with parts of it. No single box delivers all seven tenets. See the seven tenets.
Myth 2: Zero trust means getting rid of the network perimeter
Fact: The abstract says the focus moves to protecting resources rather than network segments, and that no implicit trust comes from network location. The document also describes approaches built on network segmentation as one valid route. It names three: enhanced identity governance, logical microsegmentation and network based segmentation, and says a full solution includes elements of all three. So segmentation stays. Trust based on being inside it goes.
Myth 3: We can switch over in one project
Fact: Section 7 says it is unlikely that any significant enterprise can migrate in a single technology refresh cycle. Workflows that follow zero trust may sit alongside perimeter based ones for an indefinite time, and migration may go one business process at a time. A greenfield build is called rarely viable for an organization with an existing network.
Myth 4: Zero trust means distrusting employees
Fact: The principle is not about suspicion of people. It is about not letting location or one past login stand in for a decision. Access is evaluated per session, with the requester's identity, device state and context. An employee on a patched, managed laptop can have broad access under that logic, and a stolen credential on an unknown device gets less.
Myth 5: It covers everything the company publishes
Fact: NIST says the tenets apply to work within an organization or with partners, and not to anonymous public or consumer facing business processes. An organization cannot impose internal policies on customers or general internet users, though it may apply some zero trust policies to nonenterprise users who are registered.
What the document says you need first
Before deploying, NIST advises reaching a baseline of competence with assets, subjects, business processes, traffic flows and dependency mappings identified and cataloged. Incomplete knowledge often shows up as the policy engine denying requests for lack of information, especially with unknown shadow IT. That is why a first 90 days plan starts with inventory.
Quick check
Does buying a zero trust vendor platform make us zero trust?
Not by itself. A platform can implement parts of the architecture. You still need asset knowledge, identity management and policy that reflects your business.
Is zero trust only for large federal agencies?
NIST wrote the document for federal context, but the tenets are technology agnostic and the migration advice, one process at a time, scales down.
Sources
Last reviewed: 19 October 2026.
