The email that almost worked
Farah managed the office for a 40-person firm. One Tuesday, an email arrived that looked exactly like it came from the CEO, correct name, correct signature, urgent request to approve a wire transfer. It came from outside the company, but because it had reached an internal inbox, on the internal network, nobody's first instinct was suspicion, the network itself felt like proof of legitimacy. A colleague caught it only by noticing the reply-to address didn't match. That instinct, trusting something because of where it came from, is exactly the assumption Zero Trust exists to remove.
The old model: castle and moat
Traditional network security worked like a castle with a moat: build a strong perimeter, firewalls, VPNs, and once something was inside that perimeter, it was largely trusted by default. This made sense when everyone worked from one office, on one network, using company-owned devices. It stopped making sense once work moved to home networks, personal devices, and cloud apps accessed from anywhere, the moat stopped meaning much when the castle no longer had real walls.
Zero Trust: three principles, not one product
Zero Trust is a security model built on three principles, not a single tool you buy: verify explicitly (authenticate and authorize based on all available signals, every time, not just once at the network edge), use least privilege access (give someone only the access they actually need, for only as long as they need it), and assume breach (design as though an attacker is already inside, minimizing how far they could move if they were).
Applied to Farah's near-miss: verify explicitly means checking the actual sender address and authentication signals, not just "it reached my inbox." Assume breach means the finance approval process shouldn't have relied on one email looking convincing enough, a second verification step assumes exactly this kind of thing will eventually get through.
Why identity becomes the real perimeter
With no reliable network boundary left to defend, identity, proving who is actually requesting access, becomes the control point that actually holds. This is why the next section of this course goes straight into Microsoft Entra: in a Zero Trust world, identity isn't one security feature among many, it's the foundation everything else, device security, data protection, threat detection, gets built on top of.
Check your understanding
Five questions, all from this module. Get 4 out of 5 to mark it complete.
1. What assumption made the phishing email initially seem trustworthy to Farah's colleagues?
2. What is the "castle and moat" model?
3. Which of these is one of the three Zero Trust principles?
4. What does "least privilege access" mean?
5. Why does identity become the central security control point in a Zero Trust model?