Least Trust

Security+ 🏆 • Authentication & Authorization 🔐 • Network Security 🌐 • Security Operations 🛡️ • Difficulty: premium

Definition

Least Trust is a security mindset where you assume no user, device, network segment, or request is automatically trustworthy. Access is granted only after verification, is limited to what is needed, and is continuously re-evaluated based on identity, context, and risk.

Examples

  • An employee on the corporate Wi-Fi still needs MFA and device compliance checks before accessing payroll systems.
  • A compromised laptop can reach only a small set of approved services because network segmentation and identity-based access controls limit lateral movement.

Discover 🔎

For a long time, many networks were built on an assumption: inside the network is trusted, outside is untrusted. Modern attacks broke that model. Phishing, stolen credentials, remote work, cloud services, and third-party access mean attackers can appear “inside” very quickly.

Least Trust is the response to that reality. It is the habit of treating every access request as something that must be proven, not assumed. You verify who and what is asking, you limit what they can do, and you keep checking that the situation still looks safe.

Remember: Least Trust is a mindset, not a product. It is about reducing assumptions and requiring proof for access.
Open the interactive lesson Browse more topics

Tip: The interactive version includes progress tracking, decks, and premium deep dives.