Originally published November 2021. Updated September 2026 to reflect Cyber Essentials v3.3 and the rise of automation and AI agents.
Quick answer: What is zero-trust security?
Zero trust is a security approach in which no user, device, service or network is trusted by default, even inside your own office network. Every request to access data or a system is checked against identity, device health and policy before it is allowed, and access is limited to what is needed. It replaces the old “secure perimeter” model, which assumed anything inside the network was safe.
Key takeaways
- Zero trust is an approach, not a product. You adopt it step by step, starting with identity.
- Hybrid working, cloud services and SaaS have made the network perimeter largely meaningless.
- Cyber Essentials v3.3 now makes MFA on cloud services an automatic requirement, which is a solid first step towards zero trust.
- Automations and AI agents are identities too. They need least-privilege access, just like people.
Why doesn’t perimeter security work any more?
When we first wrote this post in 2021, hybrid working was the main driver. Since then, the case has grown stronger:
- Work happens everywhere. Staff connect from home, client sites and coffee shops, on company and personal devices.
- Data lives in the cloud. Microsoft 365, Google Workspace, CRMs and dozens of SaaS tools sit outside any office firewall.
- Machines have credentials. Workflow automations, integrations and AI agents hold API keys and tokens with broad access to business systems.
- Attackers target identity. Stolen passwords and phishing bypass a perimeter entirely. Once inside a flat network, an attacker can move freely.
How does zero trust compare with traditional security?
Aspect | Perimeter security | Zero trust |
|---|---|---|
Default trust | Anything inside the network is trusted | Nothing is trusted by default |
When access is checked | Once, at the network edge | On every request, for every service |
Basis for access | Network location | Identity, device health and policy |
Remote access | VPN into the whole network | Access to specific applications only |
Impact of a breach | Attacker can move across the network | Damage is contained to what that identity can reach |
What are the core principles of zero trust?
The UK’s National Cyber Security Centre (NCSC) sets out principles for zero-trust architecture. In summary, a zero-trust organisation should:
- Know its architecture: the users, devices, services and data that matter.
- Give every user, device and service a strong identity.
- Assess behaviour and health: check that devices and services are patched and configured securely, and watch for unusual user activity.
- Use policies to authorise requests: decide access based on who, what, from where and on which device.
- Authenticate and authorise everywhere, not just at the edge.
- Focus monitoring on users, devices and services.
- Trust no network, including its own.
- Choose services designed for zero trust, with modern authentication and good logging.
The full detail is in the NCSC’s zero trust architecture guidance.
How does Cyber Essentials v3.3 relate to zero trust?
Cyber Essentials isn’t a zero-trust standard, but its latest version pushes UK organisations firmly in that direction. Version 3.3, which applies to assessment accounts created from 27 April 2026, introduced three significant changes:
- MFA is an automatic fail if missing. Not enabling multi-factor authentication on an in-scope cloud service that offers it now means failing the assessment.
- Cloud services can’t be excluded. Services such as Microsoft 365, Google Workspace and SaaS tools must be in scope.
- Critical patches within 14 days. Failing to apply high-risk or critical updates within 14 days is also an automatic fail.
Strong identity, a known inventory of services and healthy devices are exactly where a zero-trust journey begins. Meeting Cyber Essentials v3.3 gets you started; zero trust takes you further, with per-application access, continuous checks and least privilege everywhere.
How does zero trust apply to automations and AI agents?
Every workflow automation, integration and AI agent is a non-human identity with access to your systems. They are often given far more access than they need, with long-lived keys that nobody reviews. Apply the same principles to them as to people:
- Least privilege: scope each API key or service account to the specific actions it needs.
- Short-lived credentials: prefer tokens that expire, and store secrets in a vault, not in workflow settings.
- Log every action: record what each automation or agent did, and review it.
- Human approval for high-risk steps: payments, deletions and external communications should pause for a person to confirm.
We explore choosing the right automation approach in Agentic AI vs RPA vs Workflow Automation.
How do you implement zero trust step by step?
- Build an inventory. List users, devices, cloud services, applications, data stores and automations, and note who owns each one.
- Centralise identity. Connect applications to one identity provider with single sign-on, and enforce MFA everywhere, preferably phishing-resistant methods such as passkeys.
- Check device health. Manage devices centrally and only allow access from devices that are patched, encrypted and protected.
- Apply least privilege and conditional access. Give people and automations only the access they need, and adjust it based on risk signals such as location or device.
- Replace network-wide VPN access. Move to per-application access, and put an access proxy in front of legacy applications that can’t support modern sign-in.
- Monitor and improve. Centralise logs, alert on unusual behaviour, and review access regularly.
What are the most common zero-trust mistakes?
- Buying “zero trust in a box”. Products help, but zero trust is a set of principles applied across identity, devices, applications and data.
- Trying to do everything at once. Start with identity and MFA, then expand in stages.
- Forgetting non-human identities. Over-privileged integrations and AI agents are an easy way in.
- Relying on weak MFA. SMS codes and approval prompts can be phished or fatigued. Move towards phishing-resistant methods.
- Ignoring legacy applications. Old systems without modern sign-in become the weak link unless you wrap, modernise or replace them.
How High Digital can help
High Digital is ISO 27001 certified and holds Cyber Essentials Plus accreditation. We build custom software and automations with zero-trust principles built in: single sign-on, least-privilege service accounts, secrets management and full audit logging. We also provide ongoing support and security maintenance for the systems we deliver. Scope your project to talk about building securely from day one.
Frequently asked questions
What is zero trust in simple terms?
“Never trust, always verify.” Every person, device and service must prove who it is and that it’s safe each time it asks for access, and it only gets access to what it needs.
Does zero trust replace a VPN?
Often, yes. Instead of a VPN that connects users to the whole network, zero trust gives access to individual applications after checking identity and device health.
Is zero trust only for large enterprises?
No. Smaller organisations that run mostly on cloud services can adopt zero trust relatively quickly, because the core steps are identity, MFA, device management and least privilege.
Does Cyber Essentials require zero trust?
Not explicitly. But Cyber Essentials v3.3 requires MFA on in-scope cloud services, cloud services in scope, and critical patches within 14 days, all of which are foundations of zero trust.
How do you secure AI agents under zero trust?
Treat each agent as an identity: give it narrowly scoped, short-lived credentials, log everything it does, and require human approval for high-risk actions.