Traditional perimeter-based security relies on trying to separate the bad guys from the good guys and assumes that systems and traffic within the confines of the corporate network can be trusted. Zero Trust assumes that the bad guys are already in your network and have access to your applications and systems. The only practical control plane still available across all networks, devices, users, applications, and applications are identity-centric controls. With Zero Trust, no actor can’t be trusted unless theyre continually verified.”]
Source: https://www.bankinfosecurity.com/whitepapers/achieve-zero-trust-identity-security-w-9250