Every security model is an answer to the question: what do we trust, and why? For thirty years the answer was a place. Inside the network was trusted, outside was not, and the job of security was maintaining the wall between them. Zero Trust is what happened when that answer stopped describing reality. This article is the story of where the old model came from, the specific moments it broke, and the destination the replacement points at, because you cannot navigate a journey whose start and end you have not located.
The world the perimeter built
The perimeter model deserves a fair hearing before the burial, because it was a reasonable design for the world that produced it. Applications lived in a room down the hall. Data lived on servers you could point to. People worked at desks wired to a network you physically controlled, and the internet arrived through one pipe you could put a firewall on. Given those facts, concentrating defense at the boundary was sound engineering: harden the shell, keep the bad actors on the outside of it, and let the inside be soft so the business could move. The industry built decades of product and practice on that shape. VPNs existed to tunnel trusted people through the shell. Intrusion detection watched the pipe. The office network became a synonym for safety so thoroughly that being on it was the authentication.
Every assumption in that paragraph has since failed, and not gradually. The applications left for SaaS, so the crown jewels now live on infrastructure you will never see, reachable from any coffee shop on earth. The people left the building, first slowly and then all at once in 2020. The devices multiplied into laptops, phones, and tablets that spend most of their lives on networks you do not control. And the attackers stopped breaking down the wall, because it was easier to log in: phish one set of credentials and the perimeter model hands you the soft inside as a prize. The wall still stands at plenty of organizations. It just no longer has the company behind it.
The flip: 2010
The idea has a specific birthplace. In September 2010, a Forrester analyst named John Kindervag published a report whose title told you everything about its argument: “No More Chewy Centers: Introducing The Zero Trust Model Of Information Security.” The chewy center was the soft inside the perimeter model created, and the report’s move was to take the old operating mantra, trust but verify, and flip it: verify and never trust. That phrasing later hardened into the slogan everyone now repeats, never trust, always verify, but the original formulation is worth keeping because it names the actual work. Verification is not a checkpoint you pass once. It is the permanent condition, and location grants nothing.
Kindervag was not writing in a vacuum. A group of corporate security architects called the Jericho Forum had spent the mid-2000s arguing that de-perimeterization was already happening whether anyone liked it or not. What the 2010 report contributed was a name, a design stance, and a heresy stated plainly: the internal network is not a trusted zone, and building as if it were is the root defect. For most of the following decade that remained a minority position, discussed at conferences and implemented almost nowhere, because the tooling to actually do it did not exist at ordinary-company prices. What moved it from heresy to default was a demonstration.
The existence proof: BeyondCorp
In January 2010, Google disclosed that it had been penetrated by a sophisticated attack, later known as Operation Aurora, that moved laterally through internal systems exactly the way the perimeter model invites. What Google did next is the part that matters to this story. Beginning in 2011 it set an internal mission with a startlingly plain statement: enable every employee to work successfully from untrusted networks without the use of a VPN. The program was called BeyondCorp, and when Google started publishing papers about it in 2014, the industry got its first look at the perimeter-free model running at real scale. Access to every application was decided per request, based on who the user was and what device they were on and what state it was in, with the network they happened to be sitting on contributing nothing. The corporate LAN became, by design, no more trusted than a hotel’s.
Google’s mission statement was startlingly plain: enable every employee to work from untrusted networks without a VPN. The corporate LAN became, by design, no more trusted than a hotel’s.
BeyondCorp settled the argument that mattered most: this is not a whiteboard model. A company with more to lose than almost anyone ran its entire workforce this way and worked better for it, not worse. If you have ever wondered why the modern Microsoft stack looks the way it does, why device state flows into sign-in decisions, why the compliant-device check exists, why VPN-less access to internal applications is now a product category, you are looking at BeyondCorp’s ideas, industrialized and sold as services the rest of us can rent.
The institutionalization: 2020 onward
An idea becomes an era when governments write it down. In August 2020, NIST published Special Publication 800-207, which gave Zero Trust a vendor-free formal definition that has not needed a revision since: a set of tenets and a logical architecture, deliberately silent about products. In 2021, after a season of breaches that included SolarWinds, a US executive order made Zero Trust federal policy, and the strategy memo that followed, M-22-09, set concrete targets for every civilian agency, phishing-resistant MFA among them. As of this writing that memo has never been rescinded and no successor has replaced it. The Department of Defense went further and enumerated the strategy into 152 discrete activities across seven pillars, with a mandated target level due by the end of fiscal year 2027. Whatever you think of any particular mandate, the signal is unambiguous. The largest, most attacked organizations on earth evaluated the perimeter model and formally ordered themselves off of it.
The reason those documents matter to a business that will never read them is that they are vendor-neutral proof of direction. Your Microsoft rep did not write 800-207. CISA’s maturity model does not earn a commission. When the same architecture emerges from a standards body, a military, an analyst firm, and the operational experience of a company like Google, the conclusion is not that Zero Trust is fashionable. It is that the perimeter’s failure has been independently confirmed by everyone in a position to check.
The destination: every access is a decision
So where does the journey actually take you? Strip away the vocabulary and the destination is one architectural idea. In the old model, trust was a property of the network, granted implicitly and held indefinitely. In the new model, trust is the output of a decision, made fresh for each access, by something 800-207 calls a policy decision point: an engine that takes everything knowable at that moment, who is asking, from what device, in what condition, from where, at what risk, for which resource, and returns a verdict that an enforcement point carries out. Allow, deny, or allow with conditions: prove your identity more strongly, take a healthy device, hold a shorter session. The decision expires, and the next request earns its own.
If that description sounds familiar, it should. In the Microsoft estate the policy decision point has a product name, Conditional Access, and this site has an entire series on it that calls it the real control plane, which is the same claim in different words. Device compliance is how the device’s condition becomes evidence the engine can read. Identity protection is how risk becomes evidence. The network edge is where enforcement follows the traffic. Each of those is its own discipline with its own articles, and none of them is the point by itself. The point is the shape: from location as trust, to evidence as trust; from trust granted once, to trust decided always. Hold that shape and every product decision downstream gets easier to judge. The next article leaves architecture behind and asks the more personal question: when an organization actually lives this way, what changes on an ordinary Tuesday?
Zero Trust
‹ Previous: [ZT 1] Zero Trust Is Not a Product
Next: [ZT 3] What Zero Trust Changes About How You Work ›
