Zero Trust Is a Strategy, Not a Product. Here's the Difference

Zero Trust is the most oversold term in enterprise security. Every vendor has a Zero Trust product. Very few organisations have a Zero Trust architecture. The gap between those two sentences is where most programmes stall.

What Zero Trust actually is

Zero Trust is an architectural philosophy, not a SKU. It eliminates implicit trust based on network location. Every access decision is explicit, contextual, and continuously evaluated against identity, device posture, behaviour, and risk. Nothing is trusted because it sits inside a firewall.

Why most implementations fail

• Tool-first thinking. Organisations buy a ZTNA product and declare Zero Trust without touching how access decisions are designed.
• Identity debt. Zero Trust rests on identity. If the identity fabric is fragmented across legacy directories, service accounts, and orphaned tenants, the architecture has nothing to anchor to.
• No policy backbone. Without a consistent policy decision point, different systems enforce different rules and the user experience collapses.
• Legacy carve-outs. Every exception for a legacy system quietly rebuilds the perimeter Zero Trust was meant to replace.

What a real programme looks like

Successful Zero Trust programmes start with identity hygiene, define a small set of high-value protected surfaces, and iterate. They treat the eighteen-month horizon as a series of measurable decisions, not a single architectural big bang. The firms furthest ahead are those that accepted Zero Trust is an operating model change, not a project.

The commercial case

Mature Zero Trust halves the impact of breaches that do land. But the bigger commercial value is in audit posture, insurance premiums, and the ability to pass enterprise customer security reviews without a month of remediation. That is what finance directors respond to, and that is how these programmes should be sold internally.

Zero Trust works. Zero Trust products sometimes work. The difference is the programme sitting around them.