Core principles of zero trust

  • Verify explicitly: authenticate and authorise every request based on identity, device and context.
  • Least privilege: give users and services only the access they need, for as long as they need it.
  • Assume breach: design so that a single compromised account or device cannot reach everything.
  • Know your assets: keep an accurate view of users, devices, services and data, because you cannot set policy for what you do not know exists.

Why zero trust matters now

Remote working, SaaS and cloud services mean there is no longer a clear network perimeter to defend. Attackers who steal one set of credentials or compromise one exposed system often move freely once inside. Zero trust limits that movement and replaces exposed VPNs and admin interfaces with access that checks identity and device every time.

Zero trust and the external attack surface

Zero trust shrinks what is exposed, for example by putting applications behind an identity-aware proxy instead of on the open internet. But migrations take years, and legacy systems and shadow IT often remain exposed in the meantime. Continuous external attack surface management shows what is still reachable and checks that the zero trust programme is actually reducing exposure.

How DarkInvader helps

DarkInvader gives the outside-in check for a zero trust programme. It finds internet-facing services that are still directly exposed, such as legacy VPNs, admin panels and forgotten systems, and monitors daily so new exposures are caught as they appear.

Explore Asset Monitoring

Frequently asked questions

Is zero trust a product?

No. It is an architecture and set of principles. Products such as identity providers, device management and secure access services help put it into practice.

Does zero trust replace VPNs?

Often, over time. Zero trust network access gives users access to specific applications after checking identity and device, rather than placing them on the whole network as a traditional VPN does.

Where should a zero trust programme start?

With visibility: know your users, devices, applications and what is exposed to the internet. Strong multi-factor authentication for all users is usually the first major control.

Related terms and reading

Sources