The classic security model was like a castle: whoever was inside the company network was trusted. With cloud services, mobile working and attackers signing in with stolen credentials, that assumption no longer holds. Zero trust replaces it with a simple rule: every access is checked.
The principles
Verify explicitly: identity, device, location and behaviour are considered for every access. Least privilege: users and applications get only the permissions they need for their task, and only for as long as needed. Assume breach: networks and systems are segmented so a compromised account does not reach everything, and activity is logged.
What zero trust is not
Zero trust is not a product you buy but an architectural principle. Many tools support it, such as conditional access policies, device management or access solutions per application instead of a VPN for the whole network. Introducing a product labelled zero trust without rethinking rights and access does not implement the principle.
How SMEs start
The starting point is identity: MFA for everyone, few and protected admin accounts, access policies that restrict unmanaged devices and regular permission reviews. For Microsoft 365 environments our baseline configuration checklist describes these first steps. In web application code, the principle corresponds to consistently checking permissions at database level, for example with row level security.