What Is Zero Trust Architecture?

Core Components of a Zero Trust Architecture

NIST published SP 800-207, the technical definition of ZTA, in 2020. The document outlines core requirements of a zero trust architecture.

These components make up ZTA’s logical control and data plane:

• A policy engine that evaluates an access request’s context. The policy engine first evaluates risk signals and information about the user’s identity, behavior, and device posture. Then, the policy engine decides to grant, deny, or restrict access to the requested resource.
• A policy administrator that executes the policy engine’s decisions. The policy administrator either blocks or establishes a communication path between the user and the resource that user wants to access. 
• A policy enforcement point serves as a gateway. It will enable, monitor, or end the user’s connection to the resource based on the policy administrator’s commands. 

In addition to the control and data plane, ZTA includes supporting data sources such as: 

• Continuous diagnostics and mitigation (CDM), 
• Identity and access management (IAM) systems, 
• Security information and event management (SIEM) and logging platforms, 
• Public key infrastructure (PKI), and
• Threat intelligence feeds. 

Zero Trust Architecture Deployment Models

Not every organization will deploy ZTA in the same way. NIST outlines four different deployment models, and organizations should understand the tradeoffs of each before designing their implementation:

• Device agent or gateway-based: Lightweight agents on devices communicate with a gateway component that acts at the policy enforcement point. 
• Enclave-based: Resources are grouped into microsegments, also known as enclaves. Access policies are enforced at the enclave boundary.
• Resource portal-based: A portal brokers connections between users and resources. Users access the portal, rather than the network, to request access to specific resources.
• Cloud-delivered or service-based: The architecture is delivered as a cloud service. There are no on-prem hardware or per-device agents in this implementation approach. 

Each deployment model offers different levels of latency, scalability, and maintenance. Cloud-delivered models are the right choice for most enterprises because of their scalability and reduced latency

Why Zero Trust Architectures Matter

Organizations today are undergoing rapid digital transformation, driven by the adoption of cloud services, hybrid work environments, IoT devices, and SaaS applications.

Legacy tools were designed for an on-premises world. They can’t effectively scale to inspect the volume of traffic that modern, distributed organizations produce.

For example, 70% of organizations have limited or no visibility into AI-enabled threats that move over their VPNs (ThreatLabz 2026 VPN Risk Report). 

84% of enterprises surveyed by ThreatLabz researchers indicated that they were transitioning to a zero trust to fix routing and inspection bottlenecks (ThreatLabz 2026 VPN Risk Report).

The Shortcomings of Traditional Architectures

Legacy architectures were built with a “hub-and-spoke” network design. That model worked well when users, applications, and data resided in centralized, on-prem data centers.

Today, modern enterprises operate in the cloud. Users work remotely across the world. Consequently, modern organizations produce large volumes of cloud traffic.

But hub-and-spoke infrastructure can’t process that traffic without introducing inefficient routing and security concerns. 

Why Legacy Infrastructure Struggles With Scale

Traditional architectures rely on network-centric routing and appliance-based security. This approach leads to four key structural issues: 

• Infrastructure latency: Application performance degrades when organizations backhaul cloud-bound traffic through a VPN to a centralized data center. These suboptimal routing paths introduce latency. 
• Operational complexity: Managing hundreds of edge firewalls and VPN gateways is expensive and introduces misconfiguration risks. 
• Implicit network access: Legacy infrastructure grants users implicit network access once they use a VPN to connect to the network. This introduces the risk of lateral threat movement. 
• Exposed attack surfaces: Traditional VPNs and firewalls have public IP addresses. Threat actors frequently search for and use those addresses in targeted attacks.

How a Zero Trust Architecture Transforms Security

Zero trust is fundamentally different from traditional architectures. Instead of securing networks, it secures access directly to IT resources. Zero trust governs access based on context and risk, rather than identity.

A purpose-built cloud delivers the architecture as a service and at the edge. It acts as an intelligent switchboard that enables secure connections between users, devices, workloads, branches, and applications regardless of location. 

Core Tenets of Zero Trust Architecture

Adopting a zero trust architecture involves adhering to specific engineering requirements. NIST Special Publication 800-207 outlines the core tenets of ZTA, and describes how organizations must design these architectures.

Rather than focusing on zero trust principles, the NIST tenets explain how infrastructure evaluates and routes access requests. 

Every ZTA must enforce:

• Resource-based policy: All computing services and sources of data in the organization are defined as resources. Policy is applied at the data or application level.
• Secure communication: Access requests must meet the same level of security, regardless of if they’re on-network or off-network. ZTA never grants internal traffic implicit trust.
• Per-session access: Access is verified on a per-session basis.
• Dynamic policy access: Access requests are granted using dynamic policies that take into account information such as device health and behavior analysis.

Structural Benefits of Zero Trust 

1. Designed to prevent exposure: Applications are hidden behind a cloud proxy, which makes them invisible to the public internet. 
2. Elastic proxy inspection: A cloud-delivered zero trust architecture uses elastic compute resources to inspect all traffic at scale. The architecture can decrypt and re-encrypt TLS/SSL traffic without the latency or performance degradation of legacy systems. 
3. Context-aware data protection: Inline zero trust controls enforce data loss prevention (DLP) policies consistently. Context-aware DLP uses device posture, user identity, application, location, and data sensitivity signals simultaneously. 

Zero Trust Powered by AI: Real-Time Threat Detection and Automation

Enterprises transferred about 18,000 terabytes of data to AI applications in 2025, and traffic to AI/ML applications increased 83.3% year-over-year (ThreatLabz 2026 AI Security Report). With this volume of traffic and data transfer, security automation is a business requirement.

Modern zero trust architectures use AI and machine learning to make in-real-time decisions at scale. Short response times are critical given the speed of AI attacks:

How AI Strengthens Zero Trust Architectures

AI technologies replace static rules with continuous, automated analysis. 

• Verify identity: AI-enhanced behavioral analytics flag suspicious logins, such as unusual device combinations or locations, that static credential checks miss.
• Determine destination: Contextual intent analysis uses behavioral baseline data to understand why a user, autonomous workload, or AI agent needs access to a requested resource. Machine learning models continuously flag suspicious communication patterns. 
• Assess risk: AI correlates contextual signals such as user behavior and device posture to generate a real-time risk score. That risk score is continually updated throughout the session.
• Enforce policy: Adaptive policy enforcement uses real-time risk scores to grant, block, isolate, or require reauthentication. 

With AI, zero trust architectures also employ features like agentic SecOps and autonomous remediation. AI agents monitor risk signals, correlate alerts, and analyze incidents without human intervention. Autonomous remediation enables agents to respond to their findings, such as by isolating compromised devices or blocking malicious traffic.

Use Cases for Zero Trust Architectures

One of the defining strengths of zero trust is its ability to secure any-to-any connectivity. This means it can protect any of the entities that need access to your IT resources, including your:

• Workforce: Users can securely access the web, SaaS apps, and private apps without requiring network access.
• Clouds: Zero trust secures communications for workloads in public, private, and hybrid cloud environments. It protects data at rest in your clouds and SaaS apps.
• IoT/OT devices: Zero trust ensures secure connectivity for IoT and operational technology (OT) systems, protecting these critical assets from cyberattacks.
• B2B partners: Third-parties like channel partners gain secure access directly to specific apps. VPNs and network-level access aren’t necessary.

Zero Trust Maturity Model

Adopting a zero trust architecture is a multi-stage process. The CISA Zero Trust Maturity Model 2.0 is a framework that helps enterprises evaluate their maturity level. It also helps guide their zero trust implementation strategy. 

The CISA maturity model is organized around five pillars: identity, devices, networks, applications and workloads, and data. Enterprise zero trust maturity is represented by four progressive stages across these pillars: 

• Traditional: Static security policies, perimeter-centric controls, manual configurations
• Initial: Some configuration automation, beginning to use cross-pillar solutions and integrations
• Advanced: Automated configurations, centralized visibility, cross-pillar coordination
• Optimal: Fully automated, dynamic policy enforcement, cross-pillar interoperability

Understanding your organization’s current maturity level, and which pillars need the most attention, is a great first step towards improved zero trust maturity.

Considerations When Building a Zero Trust Architecture

Zero trust architectures improve organizational efficiency and security. For example, a large manufacturing company adopted a zero trust platform and deployed zero trust to 56,000 employees in nine days.

Adopting zero trust also involves some considerations: 

• As you shift towards identity and context-focused access, you’ll need to address legacy system security with microsegmentation.
• Zero trust platforms replace legacy firewalls, VPNs, and point solutions. IT must allocate time to retire those legacy systems.
• Policy complexity and sprawl increases without governance planning. Organizations should adopt a governance framework that audits policies and centralizes policy decision making to proactively manage policy sprawl.

Adopting zero trust in a phased approach is the best way to address these challenges.

What to Look For When Evaluating Zero Trust Platforms

As you evaluate vendors, make sure to assess architectural completeness and operational fit. Here are some key criteria to consider: 

1) Comprehensive Coverage Across All Entities

A true zero trust platform secures access for all critical entities within an organization. This includes secure access for the workforce, applications and clouds, IoT/OT systems, and partners. To maintain a consistent security posture, unified protection across these vectors is essential. 

2) Architecture Completeness

Does the platform address the entire NIST SP 800-207 architecture model natively? If you’re required to manage identity, network, device, and data separately, that platform won’t help you mature your architecture. 

3) Deployment Model Fit

If your organization has remote employees, OT requirements, or multicloud environments, you’ll need a cloud-delivered zero trust platform. 

4) Scalability and Performance at a Global Level

Can the platform inspect TLS/SSL traffic at scale? If the vendor uses an appliance-based approach, it’s likely that traffic backhauling will introduce latency. 

Look for cloud-delivered platforms that have the infrastructure to support users, applications, and workloads across multiple geographies. Low latency, high availability, and reliable connectivity should be top priorities.

5) Integration Ecosystem

Look for a vendor that supports integrations with your existing identity providers, SIEM/SOAR solutions, and endpoint posture tooling.

6) Independent Validation

Choose a vendor that earned analyst recognition. Read analyst reports such as The Forrester Wave™ for secure access service edge (SASE) or the Gartner^® Magic Quadrant™ for Security Service Edge (SSE) and SASE. Analyst validation in SSE and SASE product categories are key because SSE and SASE help enterprises adopt zero trust at scale.

Zscaler and Zero Trust Architecture

The Zscaler Zero Trust Exchange is the world’s largest AI-enhanced inline cloud security platform. It uses predictive AI and machine learning to prevent cyberattacks and secure enterprise AI adoption.

With Zscaler, enterprises get: 

• AI Security and Governance: Zscaler provides visibility into GenAI tool usage, enforces granular DLP policies, and helps maintain compliance.
• AI-Driven Threat Prevention: AI-powered app segmentation reduces the internal attack surface and the risk of lateral movement.
• Intelligent Data Protection: An advanced AI data security fabric auto-classifies data and prevents data loss across SaaS, internet, and AI channels.
• Streamlined Operations: AI-powered root cause analysis helps resolve digital experience issues before they reduce productivity.

To learn more about Zscaler, request a demo.