AI Trend Research

← AI glossary

AI glossary · Basic · AI security · AI platforms & solutions

Zero trust

Zero trust is a security approach that drops the idea of 'trust it because it is inside the company' and instead checks who is asking and whether they have permission every time a person, device or program accesses a resource.

About this term
Level
Basic · Technical terms you often meet in AI news
Added
2026-10-09
In plain words In an old office building, a badge at the front door let you go to every floor; zero trust is like having to scan your badge again at the door of every room. In practice, though, people do not have to go through tedious checks each time; most of the checking is done automatically by systems in the background.

How it works

When a user or program tries to access data or a service, its identity (who it is) is checked first. Next, contextual information is also considered, such as whether the device being used is secure and whether the access location or time is unusual. Based on policy, access is allowed or blocked, and even when it is allowed, only the scope that is strictly needed is opened. Getting in once is not the end: if unusual behavior appears during the session, access is checked again or cut off.

How access requests are checkedAccess request → Identity check; Identity check → Context check; Context check → Policy decision; Policy decision → Only the needed scope(Allowed); Only the needed scope → Continuous monitoring; Continuous monitoring → Identity check(If unusual)Access requestPeople, devices,agentsIdentity checkContext checkDevice, location, timePolicy decisionAllow or blockOnly the neededscopeResource accessContinuousmonitoringAllowedIf unusual
How access requests are checked Each time a request comes in, identity and context are reviewed and the allowed scope is set by policy. Unusual behavior during the session sends it back to checking.

Why it matters

As cloud computing and remote work have grown, the boundary of 'inside the company network' has blurred. With an approach that only guards the perimeter, an attacker who gets inside once can move around freely. Because zero trust divides access into small pieces and checks every time, it limits the spread of damage even if one point is breached. As AI agents increasingly access multiple systems on behalf of people, there is growing discussion about applying the same principles to agents.

Perimeter security vs. zero trust

Perimeter securityGuarding the castle walls

  • Trusts anything inside the internal network
  • Broad access once inside
  • Damage spreads easily if breached

Zero trustChecking every time

  • Checks regardless of location
  • Allows only the needed scope
  • Keeps checking during the session

공통 Both aim to let only authorized people reach resources

The left side is the older approach that trusts the inside; the right side is the approach that checks every time.

Good to know

Zero trust is not a single product but a design principle and direction. It requires several elements working together, such as identity management, device management, access policies, and logging and monitoring. Because it is hard to change existing systems all at once, it is usually applied step by step, starting with the most important resources. It is often paired with the principle of least privilege, which grants only the permissions that are strictly needed.

Example

When an internal AI chatbot accesses a document search tool, it is not given access to all documents just because it is on the company's internal network. The identity and permissions of the employee who asked the question are checked so that the chatbot searches only the documents that employee is allowed to see, and each tool call the agent makes is logged and inspected. This way, even if the chatbot is tricked by prompt injection, the chance of material it should not see leaking out is reduced.

Related terms

Principle of least privilege AI agent Prompt injection Data exfiltration Sandbox Guardrails