The original Zero Trust pitch was simple: never trust the network, always verify. Five years on, the perimeter has dissolved further — workforce is hybrid, workloads are multi-cloud, agents and APIs make more requests than humans. Zero Trust 2.0 is what happens when identity, not network location, becomes the single primary control.
VPN vs ZTNA — a one-table summary
| Capability | Traditional VPN | Zero Trust Network Access |
|---|---|---|
| Trust model | Network-based, broad once authenticated | Per-request, identity + context |
| Lateral movement risk | High — flat once inside | Low — segmented by policy |
| User experience | Connect-then-work | Continuous, transparent |
| Device posture checks | At connect | On every request |
| Auth factors | Often password + OTP | Phishing-resistant, passwordless |
What 'identity-first' actually means
- Phishing-resistant credentials — passkeys (WebAuthn / FIDO2) replace passwords and SMS OTP entirely.
- Continuous verification — behavioural biometrics, device posture, and risk signals re-evaluate the session in real time.
- Just-in-time access — privileges are granted for minutes, not granted for years.
- Workload identity — services and AI agents authenticate with the same rigour as humans.
What breaks when you turn it on
Zero Trust 2.0 makes invisible assumptions visible. Service accounts that worked for a decade because nobody checked stop working. Tooling that hardcoded an internal IP allowlist needs rewriting. Plan a six-month rollout: identity inventory, policy authoring, gradual enforcement with break-glass paths, then deprecation of legacy access.
Planning a Zero Trust rollout or modernising identity infrastructure? Reach out via the contact section.
Frequently asked questions
- ZTNA is one component — the network access piece. Zero Trust is the broader strategy that also covers identity, devices, applications, data, and workloads.
- Yes, for most workforce use cases. Passkeys are phishing-resistant, bound to the device, and fall back to platform biometrics. The migration cost is real but bounded.
- They get workload identities, scoped tokens, short-lived credentials, and the same behavioural monitoring as human users. Treating an agent as 'just another internal service' is the most common mistake.
