Implicit trust by default
A shared admin password, a VPN granting broad access once connected, an ex-employee’s login still active months later. Common at small businesses with no dedicated security function.
SECURITY · ZERO TRUST
Nobody gets standing access, including us
Zero trust means no user, device or system is trusted by default, even one already inside the network. Every request has to prove itself, every time, rather than being waved through because it came from somewhere considered safe.
A perimeter fails once, completely. If a credential leaks or a device is compromised, a trust-the-inside model gives an attacker broad access from that single point. Zero trust limits what any one compromised account can actually reach.
THE RANGE OF PRACTICE
What implicit trust looks like, and what checking every request looks like
Described by behaviour, not by a score.
Trust the perimeter, not much past it
A firewall and a login screen, but little checked once someone is inside. Typical of mid-size teams that have not revisited access control since it was first set up.
Access granted per task, expiring on its own
Every request verified against what that specific user or system needs right now, with access removed automatically rather than remembered manually.
WHERE WE SIT
Access granted for the task, expiring when it ends
Applied to our own team first, not only to what we build for clients.
Nobody on our team gets standing access to a client system by default, including us. Access is granted for what a specific task requires and expires when the task ends, rather than being remembered manually and cleaned up eventually. It is the same principle built into the systems we hand over: least privilege by default, not broad access trimmed back later.
STRAIGHT ANSWERS
Questions about zero trust
The ones that come up before anyone signs anything.
No user, device or system is trusted by default, even one already inside the network. Every request has to prove itself, every time, rather than being waved through because it came from somewhere considered safe. It is a design principle, not a single product you buy and install.
A perimeter fails once, completely. If an attacker gets past the firewall or a credential leaks, a trust-the-inside model gives them broad access from that single point. Zero trust limits what any one compromised account or device can actually reach.
Both. Nobody on our team gets standing access to a client system by default, including us. Access is granted for what a specific task requires and expires when the task ends, the same principle applied internally that we build into client systems.
No, and a VPN can be the opposite of zero trust if it grants broad network access once connected. Zero trust checks every individual request against what that specific user or device is allowed to do, rather than granting wide access because a connection was established.
Send us your website address. We will tell you what is exposed.
The free technical audit covers security headers, plugin and theme inventory, known vulnerabilities and whether your admin login is publicly reachable. Two days, no charge, no obligation.