Old model: trust everything inside the firewall. New model: verify every request with identity, device posture, and risk signals.
Practical building blocks: MFA (Multi-Factor Authentication) + CA (Conditional Access) + compliant device + SSO (Single Sign-On) + EDR (Endpoint Detection and Response) + segmented networks.
ZTNA (Zero Trust Network Access) replaces VPN (Virtual Private Network) with per-app brokered access.