465 billion US dollars – that is how much the authors of a study by Zscaler and Marsh McLennan (PDF-Download) from 2025 estimate the global damage that could have been avoided in eight years through the consistent implementation of a zero-trust architecture. The situation in Europe is even more alarming: according to the study, 41 per cent of the security incidents analysed there are considered potentially preventable.
The message is clear: cyber incidents are no longer solely the result of highly complex attacks. They are often the consequence of structural failures in architecture, access control and identity management.
Why a mere ‘protective wall’ is no longer sufficient
The classic security model is based on a logic that was long taken for granted: the outside is dangerous, the inside is trustworthy. For decades, this thinking shaped the architecture of corporate networks, with clearly defined boundaries and a protective wall designed to shield everything behind it.
But this paradigm no longer holds true. The conditions under which companies operate today have changed fundamentally:
- No clear perimeter: Data and workloads are distributed across multi-cloud environments, on-premises systems and SaaS platforms. The corporate network is no longer a closed space, but a dynamic ecosystem.
- Hybrid working models: Employees, partners and service providers access resources regardless of location and using a wide variety of end devices. Identities constantly move across system and organisational boundaries.
- Automated attacks: Attackers are shifting their focus away from deceiving users and towards the automated exploitation of web attack surfaces (Link in German) . Attackers no longer need human error; an opportunity is enough.
- Identities as a gateway: Access data, tokens and privileged accounts are also important targets for attack. Anyone who logs in with legitimate rights can bypass traditional protection mechanisms.
This does not render traditional IT security obsolete, but it does weaken it structurally. The real problem today is less a lack of technology than implicit trust within complex infrastructures. As long as ‘internal’ is automatically considered ‘trustworthy,’ the attack surface remains larger than any firewall could ever compensate for.
Zero Trust as the logical response to structural risks
This is precisely where Zero Trustcomes in. Not as an additional security tool, but as an architectural principle that consistently replaces implicit trust.
Where there is no longer a clear perimeter, Zero Trust protects critical data and systems through continuous verification: every access is checked based on context, regardless of whether it originates from the internal network, the cloud or outside the organisation. Security is not based on location, but on identity, device status and risk profile.
Where hybrid working models undermine traditional control mechanisms, Zero Trust enables secure, location-independent access: Employees, partners and service providers are given exactly the rights they need – no more and no less. This increases security without slowing down productivity.
Where automated attacks exploit vulnerabilities in seconds, Zero Trust systematically reduces the attack surface: lateral movement within the network is severely restricted through the principle of minimal rights assignment, micro-segmentation and continuous monitoring. Compromised access does not automatically mean a compromised company.
And where identities become the primary target, Zero Trust shifts the security focus precisely there: to access rights, authentication and transparency. Overprivileged accounts, orphaned permissions and uncontrolled service access can be systematically eliminated.
In addition to the security benefits, this approach offers further strategic advantages: an integrated zero trust architecture reduces tool proliferation, creates clear governance structures and enables measurable progress along a defined roadmap. Security becomes plannable and therefore controllable.
Zero Trust is therefore less of a radical break than a logical further development of existing security structures. The difference lies not in individual technologies, but in attitude: trust is not assumed, but continuously verified.
