Zero Trust (security model)

Zero Trust replaces the older "castle and moat" assumption — that anything inside the corporate network perimeter is safe — with a default-deny posture: every request for a resource gets verified on its own merits, regardless of whether it originates from an office desktop or a laptop on public Wi-Fi. The shift happened largely because the perimeter itself stopped meaning much once remote work, cloud apps, and BYOD became normal — there was no longer a clean "inside" to trust.

In practice, Zero Trust is a bundle of controls rather than one product: strong identity verification (MFA on every login, not just the first one), device posture checks (is this specific device patched and encrypted before it gets access), least-privilege authorization (a user or service account gets exactly the permissions the task requires, not broad network access by default), and segmentation (a breach in one area doesn't grant a free path to everything else).

For an MSP, the principle applies with extra weight to the MSP's own access into client environments — the RMM agent, remote-control sessions, and any credential used to manage a client system are high-value targets in their own right, so verifying every command cryptographically rather than trusting anything that arrives over the right network connection is Zero Trust applied to the very tool doing the managing.