BLOG

By David Chernitzky, Co-Founder and CEO, Armour Cybersecurity  |  Serving organizations across Canada, the US, and beyond  |  Last updated August 20, 2026

Quick answer: Zero trust is a security model that replaces the assumption that everything inside the corporate network is trustworthy with the principle that no connection, user, or device is trusted by default regardless of where it originates. In the zero trust model, identity is the primary security boundary: every access request is authenticated and authorized based on the identity of the requestor, the health of the device they are using, the sensitivity of the resource they are requesting, and the context of the request. This is not a product you buy; it is an architecture you build. It requires MFA enforced for every user, conditional access policies that evaluate device compliance and risk signals before granting access, privileged accounts vaulted and session-recorded, and access reviewed regularly to remove what is no longer needed.

Key Takeaways

• The network perimeter has dissolved. Employees work from home, coffee shops, and client sites. Applications run in SaaS platforms, public clouds, and on-premises simultaneously. Partners and contractors access corporate systems from networks the organization does not control. The traditional security model that trusted anything inside the corporate network and blocked everything outside it cannot function in this environment. The security boundary that does function is identity: the verified identity of the person or system making each access request.
• Zero trust is a principle, not a product. Vendors sell products labeled as zero trust solutions. These products can be components of a zero trust architecture. The architecture itself is a design decision that determines how authentication, authorization, access policies, device compliance, and network access interact to enforce the principle that trust must always be earned rather than assumed. Building the architecture requires design, implementation, and ongoing governance, not a single product deployment.
• MFA is the most impactful single zero trust control. It is also the one with the highest gap in most organizations: MFA enforced for standard users but not for administrators, MFA required for VPN but not for cloud applications, or MFA using weaker methods such as SMS codes that are vulnerable to SIM swapping rather than authenticator apps or hardware tokens. A zero trust identity architecture enforces MFA consistently across all users, all applications, and all access methods with no exceptions.
• Conditional access policies are the mechanism that makes zero trust adaptive. A conditional access policy evaluates multiple signals when an authentication request arrives: the identity of the user, the device they are authenticating from, the location of the request, the sensitivity of the application being accessed, and whether there are risk signals such as anomalous login behavior or known-compromised credentials. The policy can allow access, require step-up MFA, require device compliance verification, or block access based on the combination of signals. This context-aware access control is what distinguishes zero trust from simply requiring a password.
• SSO (Single Sign-On) is a zero trust enabler, not a security risk. SSO consolidates authentication to a central identity provider, creating a single auditable authentication point where conditional access policies and MFA enforcement can be applied consistently across all applications. Without SSO, each application manages its own authentication, making it impossible to enforce consistent MFA and conditional access across the application portfolio and impossible to have a single view of who is authenticated to what.

What the Network Perimeter Assumption Cost Organizations

The traditional perimeter security model made a fundamental assumption: if traffic originates from inside the corporate network, it can be trusted. Firewalls blocked traffic from outside the perimeter. Once a device was connected to the corporate network, through the office LAN or through a VPN from home, it was treated as a trusted endpoint with access to internal systems. Security controls were concentrated at the network boundary.

This assumption has been systematically invalidated over the past decade. Attackers who compromise a single endpoint through phishing, who obtain VPN credentials through credential stuffing, or who compromise a remote access pathway through an unpatched vulnerability are immediately inside the trusted network with the same access as a legitimate employee. The assumed trust granted by network location is exactly what attackers exploit: once they are inside the perimeter, internal network traffic often receives far less scrutiny than external traffic, and lateral movement is limited only by whatever internal segmentation happens to exist.

The shift to hybrid and remote work completed the dissolution of the perimeter for most organizations. When employees connect from home networks and public Wi-Fi, when applications run in SaaS platforms that are never on the corporate network, and when contractors access systems from networks the organization has no visibility into, the inside-versus-outside distinction that the perimeter model relies on no longer maps to the actual traffic flows of the organization. This is the shift that NIST codified in Special Publication 800-207, its Zero Trust Architecture standard, which defines trust as something evaluated per request rather than granted by network location.

The Components of Zero Trust Identity Architecture

Identity provider as the authentication hub

A zero trust identity architecture is anchored by a central identity provider (IdP) that is the authoritative source of identity for all users and devices in the environment. Microsoft Entra ID (formerly Azure Active Directory), Okta, Ping Identity, and Google Cloud Identity are examples of enterprise identity providers. All authentication flows through the IdP, which enforces MFA and conditional access policies at the point of authentication before any application-specific access is granted. The IdP is also the integration point for SSO: applications delegate their authentication to the IdP rather than managing it independently, which creates the single enforcement point where zero trust policies apply consistently across the application portfolio.

Directory modernization, which consolidates legacy on-premises directories into or alongside a cloud identity provider, is often a prerequisite for building a zero trust architecture. An organization whose identity infrastructure consists of Active Directory with no cloud integration cannot enforce cloud-native conditional access policies or integrate modern SaaS applications into SSO. The directory modernization phase of an identity and privileged access management engagement designs the hybrid identity architecture that connects the existing on-premises directory with the cloud identity provider while the migration to a fully cloud-managed identity posture proceeds over time.

MFA and conditional access

Multi-factor authentication prevents compromised passwords from being sufficient for account access. In a zero trust architecture, MFA is not optional for any user or any access method: employees, administrators, contractors, and vendors all authenticate with MFA for every access session. The MFA method matters: SMS-based one-time codes are vulnerable to SIM swapping and real-time phishing attacks that intercept the code. Authenticator app-based time-based one-time passwords (TOTP) are more resistant. Hardware security keys (FIDO2/WebAuthn) provide the highest assurance and are phishing-resistant because the key is bound to the specific site it was registered for. A zero trust IAM program specifies the required MFA method by user risk tier, requiring higher assurance methods for privileged accounts and access to sensitive systems.

Conditional access policies add context to the authentication decision. A conditional access policy can require that a device must be managed and compliant with the organization’s security policies (patched, encrypted, with EDR installed) before access to sensitive applications is granted from that device. It can block or require step-up authentication for logins from countries or IP addresses the organization has no legitimate business in. It can require re-authentication after a session has been idle for a defined period. It can block legacy authentication protocols that do not support MFA. These policies implement the adaptive, context-aware access control that is the practical expression of zero trust principles.

Least-privilege access and access governance

Zero trust architecture enforces least-privilege access: every identity has only the permissions it needs for its specific function, nothing more. This principle applies to user accounts (accessing only the applications and data relevant to their role), administrator accounts (vaulted through privileged access management with just-in-time access), service accounts (scoped to the minimum permissions required for the specific service they support), and cloud IAM roles (limited to the specific API actions and resources the workload needs). Enforcing least privilege requires knowing what permissions every identity currently has, reducing those permissions to the appropriate scope, and maintaining that reduction over time through access governance.

Access governance is the operational process that prevents privilege creep, the gradual accumulation of access that accumulates as people change roles, take on additional responsibilities, and are granted temporary access that is never removed. A quarterly access review process requires managers and application owners to certify that each person on their team has only the access appropriate for their current role. Exceptions to the minimum access standard are documented and approved. Access that is no longer appropriate is revoked as part of the review cycle rather than waiting for the next lifecycle event. Armour Cybersecurity designs and operationalizes the quarterly access review process as part of its identity and privileged access management engagement, producing the certification templates, reviewer assignments, and exception handling workflows that make the review sustainable rather than a manual burden.

Frequently Asked Questions

Is zero trust achievable for a mid-market organization?

Yes. Zero trust is a spectrum, not an all-or-nothing state. The CISA Zero Trust Maturity Model and NIST SP 800-207 both describe maturity levels from traditional to advanced, and every organization can make meaningful progress regardless of its starting point. The highest-impact zero trust controls for mid-market organizations are MFA enforcement across all users and admin accounts (eliminating the most common attack vector), SSO consolidation to create a single conditional access enforcement point, PAM vaulting for privileged accounts (eliminating shared credentials and adding session recording), and quarterly access reviews (maintaining least privilege over time). These controls do not require the advanced microsegmentation and continuous monitoring infrastructure of a mature enterprise zero trust program, but they close the majority of the identity attack surface that attackers exploit.

What is the difference between SSO and federation?

Single Sign-On (SSO) allows a user to authenticate once to a central identity provider and then access multiple applications without re-authenticating for each one. The user logs in once; the identity provider issues a session token or assertion that the connected applications accept as proof of authentication. Federation is the protocol and trust relationship that makes SSO work across organizational or technology boundaries. SAML (Security Assertion Markup Language) and OIDC (OpenID Connect) are the federation protocols used by most enterprise SSO implementations. When an organization says an application is SSO-integrated, it means the application is configured to accept authentication assertions from the identity provider through one of these federation protocols rather than managing its own authentication database. For the user, SSO means one login. For the security team, SSO means one place where MFA is enforced, conditional access policies apply, and authentication events are logged.

How does zero trust interact with remote work security?

Zero trust is particularly well-suited to remote work environments because it does not rely on network location as a trust signal. A remote worker authenticating from home receives the same identity verification as a worker in the office: MFA is required, device compliance is checked, conditional access policies evaluate the request context, and access is granted or denied based on identity and context rather than network position. The VPN-based remote work model, which extends corporate network access to remote users and then grants them broad access to internal systems based on network membership, is architecturally inconsistent with zero trust because it grants trust based on network location (VPN connection) rather than identity context. Zero trust remote access uses identity-aware proxies, cloud-delivered access, and application-level conditional access rather than network-level VPN tunnels, though many organizations operate both during a transition period.

What should we prioritize if we are starting a zero trust program from scratch?

Starting from scratch, the highest-impact sequence is: first, enforce MFA for all administrative accounts and all users with access to sensitive data or systems, because compromised credentials without MFA is the most common breach pattern and MFA is the control with the clearest impact on that specific risk. Second, deploy SSO to consolidate authentication for the most sensitive applications into the identity provider where MFA and conditional access can be consistently enforced. Third, implement PAM to vault privileged credentials and add session recording for administrative access. Fourth, build the access governance process, starting with quarterly access reviews for privileged accounts and expanding to the broader user population as the process matures. This sequence is not the only valid approach, but it prioritizes the controls with the highest risk reduction per unit of implementation effort, which is the practical definition of starting well.

The Bottom Line

The old security model trusted anything inside the network and blocked everything outside it, and that distinction stopped mapping to reality the moment employees went remote, applications moved to SaaS, and contractors started connecting from networks no one controls. What still works as a boundary is identity: who is making the request, on what device, for what resource, in what context. Zero trust is the architecture that enforces that, and it is built rather than bought. The controls that deliver most of the value are the achievable ones: MFA everywhere with no exceptions, SSO to create a single enforcement point, privileged accounts vaulted with session recording, and access reviewed on a schedule so privilege stops creeping. Frameworks like NIST SP 800-207 and the CISA Zero Trust Maturity Model confirm this is a progression, not a switch, so every organization can start where it is. Armour Cybersecurity’s identity and privileged access management engagement designs and builds that architecture end to end, from directory modernization through conditional access and access governance.