Zero trust has been attached to enough products that the term has lost most of its diagnostic value. Stripped of the marketing, it describes a coherent and useful architectural position, and understanding it as a position rather than a purchase makes it considerably more actionable.
The actual principle
Conventional network security assumes a trusted interior and a hostile exterior, defended at the boundary. Once inside, access is largely implicit.
Zero trust removes the implicit trust. Every access request is evaluated on its own merits — who is asking, from what device, in what state, for what resource — regardless of network position. Being on the corporate network confers nothing.
That is the whole idea. Everything else is implementation.
Where the work actually is
Identity. If you cannot establish reliably who is making a request, nothing downstream works. This means consolidated identity, strong authentication everywhere including service accounts, and privilege that reflects current role rather than accumulated history. This is the largest single piece of work and the one with the most benefit independent of any zero trust ambition.
Inventory. You cannot make per-device access decisions about devices you do not know exist. Most organizations have a materially incomplete picture of what is connected, and closing that gap is unglamorous discovery work.
Segmentation. Per-resource access control requires the network to be able to enforce it. Flat networks cannot.
Policy. Written decisions about which identities, in which states, may reach which resources. Without this, tooling has nothing to enforce.
A realistic sequence
Nobody arrives at this in one programme, and organizations that attempt it that way generally stall. The sequence that works: fix identity and authentication, build inventory, segment the obvious boundaries, then apply per-resource policy to the highest-value systems first.
Each of those steps improves security posture on its own terms whether or not the next one happens. That is the practical argument for treating zero trust as a direction rather than a destination — the intermediate states are all better than the starting point, and none of them are wasted if priorities change.