Is zero trust a product I can buy?

No. NIST SP 800-207 describes zero trust as a set of principles and an architecture, not a single product. Organisations build it from several capabilities: strong identity and authentication, device posture, policy decision and enforcement points, privileged access controls, asset inventory, and monitoring. Vendors supply parts; the architecture and policies are the organisation's own work.

Where should a zero trust programme start?

Most programmes start with identity and the highest-value resources: enforce strong authentication, inventory the assets and accounts that matter, remove standing administrator rights, and put privileged sessions behind a broker that checks policy per request. CISA's maturity model gives a staged path across identity, devices, networks, applications and data, so progress can be measured pillar by pillar.

Glossary

Zero trust

Also called zero trust architecture, ZTA, zero trust security, never trust, always verify

Zero trust is a security model that grants no implicit trust based on network location or asset ownership, and instead authenticates, authorises and evaluates every request to a resource on its own merits, with least privilege, before and during each session.

Rudratic glossary

Zero trust drops the old assumption that anything inside the corporate network is safe. Each request to a server, database, application or cloud console is checked against who is asking, from which device, for what, and under which conditions, and is granted only the access that task needs. Trust is never carried over from one resource to the next.

Where the definition comes from

The reference text is NIST SP 800-207, Zero Trust Architecture, published in August 2020. The NIST glossary defines zero trust as a collection of concepts designed to minimise uncertainty in enforcing accurate, least privilege per-request access decisions in the face of a network viewed as compromised. SP 800-207 states that no implicit trust is granted to assets or user accounts based solely on their physical or network location or on asset ownership.

How it works

SP 800-207 lists seven tenets. In short:

All data sources and computing services are resources.
All communication is secured regardless of network location.
Access to each resource is granted per session, with the least privileges needed.
Access is decided by dynamic policy, including identity, application and device state, and may include behavioural and environmental attributes.
The enterprise monitors the integrity and security posture of all owned and associated assets.
Authentication and authorisation are dynamic and strictly enforced before access is allowed.
The enterprise collects information about assets, network and communications to improve its security posture.

Architecturally, a policy decision point evaluates each request and a policy enforcement point sits in front of the resource, allowing, limiting or ending the session.

Why it matters

Remote work, cloud services and third-party access mean many users and resources are no longer inside a perimeter. CISA’s Zero Trust Maturity Model gives organisations a staged path, with four stages (Traditional, Initial, Advanced, Optimal) across five pillars: Identity, Devices, Networks, Applications and Workloads, and Data, plus cross-cutting visibility and analytics, automation and orchestration, and governance.

Zero trust vs perimeter security

	Perimeter model	Zero trust
Basis of trust	Being on the internal network	Each request, evaluated on its own
Privileged access	Standing admin rights	Per-session, least privilege, often just in time
Lateral movement	Easy once inside	Each hop needs a fresh decision
Visibility	At the edge	Per resource and per session

Examples

An administrator on the office network still goes through the same broker, MFA and approval as one working from home.
A database session is granted for one task and does not grant access to the next database.
An unmanaged device is refused access to production consoles.

How SWOT supports it

SWOT products act as enforcement and visibility points for privileged access. SWOT PAM and SWOT Cloud PAM broker each privileged session through a proxy or gateway that checks policy and grants time-bound access. SWOT Radar keeps a live inventory of devices and who can log in to them, and SWOT DAM scores database identities against their own baseline. See NIST alignment.

Questions

Is zero trust a product I can buy?: No. NIST SP 800-207 describes zero trust as a set of principles and an architecture, not a single product. Organisations build it from several capabilities: strong identity and authentication, device posture, policy decision and enforcement points, privileged access controls, asset inventory, and monitoring. Vendors supply parts; the architecture and policies are the organisation's own work.
Where should a zero trust programme start?: Most programmes start with identity and the highest-value resources: enforce strong authentication, inventory the assets and accounts that matter, remove standing administrator rights, and put privileged sessions behind a broker that checks policy per request. CISA's maturity model gives a staged path across identity, devices, networks, applications and data, so progress can be measured pillar by pillar.