Your firewall protects nothing — Zero Trust checks every packet like it came from the Internet
NIST published SP 800-207 in August 2020, the Biden administration mandated Zero Trust for all US federal agencies in January 2022, and Google has been running BeyondCorp internally since 2011 without a VPN. If your network security still relies on the assumption that a packet is clean because it originated on the LAN, you have already lost.
In August 2020, NIST published SP 800-207, the standard that formally buried the network perimeter model. In January 2022, the US Office of Management and Budget ordered every federal agency to migrate to a Zero Trust Architecture by the end of fiscal year 2024. Internally, Google has been running BeyondCorp — its Zero Trust implementation — since 2011, serving over 100,000 employees with no VPN. These three dates are not a coincidence: they tell the story of the firewall’s end as a credible sole defense.
The principle is radical. Where a traditional firewall trusts anything arriving from the internal network, Zero Trust starts from the opposite assumption: no packet is trustworthy by default, whether it comes from the Internet, the accounting VLAN, or the Ethernet cable plugged into your desk. Every request is authenticated, authorized, and encrypted individually, as if the network did not exist.
Why the castle-and-moat model is dead
The traditional model — a perimeter firewall, a VPN for remote workers, and implicit trust once inside — assumes three things that have not been true for years. First, users are no longer in offices: in 2025, 58% of US employees worked hybrid or fully remote according to the Bureau of Labor Statistics, and the trend has not reversed in 2026. Second, applications no longer run in the datacenter: SaaS and cloud workloads account for over 50% of enterprise IT spending according to Gartner. Third, attackers no longer just knock on the front door: the Latrodectus ransomware, active since 2023, spreads laterally from workstation to workstation the moment a single user opens the attachment.
The result: the “inside” is just as hostile as the “outside.” The perimeter firewall has become what the industry calls an M&M network — a hard shell on the outside, a soft and defenseless interior. Once the shell is breached, the attacker moves freely. Zero Trust replaces that shell with systematic, per-packet verification, as if every request were crossing the open Internet.
What NIST SP 800-207 actually says
The NIST SP 800-207 standard (August 2020, supplemented by SP 800-207A in 2024) does not describe a product — it describes an architecture. Its principles fit into three statements:
- Access is never determined by network location. Whether you are at the office, at home, or in an airport, the verification level required is identical.
- Authentication and authorization are distinct functions, performed before every session. You do not “log in once and trust forever”: every access to a resource triggers a contextual check (identity, device posture, time of day, behavior).
- Trust is dynamic and revocable at any moment. A device that was healthy five minutes ago may be compromised now; access must be cut in real time, session by session.
NIST also defines the logical components of a ZTA: a Policy Engine (PE) that makes the access decision, a Policy Administrator (PA) that executes it by opening or closing the session, and a Policy Enforcement Point (PEP) that intercepts every request and submits it to the PE before letting it through. This trio replaces the firewall+VPN pair: instead of a single checkpoint at the network edge, every resource becomes its own checkpoint.
BeyondCorp: proof it works at scale
Google is the most compelling Zero Trust laboratory. The BeyondCorp project, launched in 2011, had a simple goal: allow any employee to work from any network without a VPN. As of 2026, over 100,000 Googlers use BeyondCorp daily to access internal applications, and Google has publicly documented the migration through a series of seven research papers (2014–2024).
The BeyondCorp architecture rests on three pillars. An Access Proxy sits in front of every internal application, refusing any unauthenticated connection — the service itself is never directly exposed, even on the internal network. A continuous device inventory evaluates the state of every machine in real time (patch level, certificates, presence of a security agent). And a policy engine combines user identity, device posture, and resource sensitivity to grant or deny access, never trusting the source IP address.
The lesson of BeyondCorp is not “buy Google.” It is that a Zero Trust architecture has been working at the scale of a multinational corporation for over a decade. The challenge for the rest of the world is replicating this model without Google’s in-house infrastructure — and that is where three modern solutions come in.
Three solutions to replace your firewall
The market has organized around three complementary approaches, from lightest to most comprehensive.
Tailscale (founded 2019) is a WireGuard-based overlay mesh that connects all your devices peer-to-peer — no VPN concentrator, no open ports, no firewall configuration. Each node authenticates via your identity provider (Google, GitHub, Microsoft, Okta) and receives an ephemeral WireGuard key that Tailscale’s control plane rotates automatically. The result: a private mesh network where each machine only sees the other machines you have explicitly authorized — and where traffic between two nodes in the same datacenter does not route through the US West Coast. The free plan covers up to 100 devices and 3 users; the Team plan starts at $6 per user per month.
Cloudflare Zero Trust (formerly Cloudflare for Teams) is a full SASE platform that replaces the VPN, the web proxy, and part of the firewall in one go. It leverages Cloudflare’s global network (330 data centers in over 120 countries) to enforce security policies as close to the user as possible. Cloudflare Tunnel (cloudflared) creates a single outbound connection from your infrastructure to Cloudflare — no inbound port to open on your firewall. Cloudflare Access authenticates every HTTP request against your IdP before it reaches the service. Gateway acts as a Secure Web Gateway (SWG) with DNS filtering, browser isolation, and DLP. The free plan includes 50 users with core features; the Pay-as-you-go plan starts at $7 per user per month.
OpenZiti (an open-source project sponsored by NetFoundry) pushes Zero Trust even further with the concept of dark services. Unlike Tailscale, which creates a private mesh network, OpenZiti exposes no listening ports at all: the service itself initiates an outbound connection to the mesh, and only an authenticated and authorized endpoint can reach it. The result: a port scanner sees nothing, even from the same network segment. OpenZiti provides tunnelers for existing applications and SDKs (Go, Python, Java, C, Node.js) to embed Zero Trust directly into application code — the deepest integration level of the three solutions. Everything is self-hosted, under the Apache 2.0 license, eliminating third-party dependency for the control plane. A hosted SaaS offering (NetFoundry Cloud) exists for those who prefer not to operate their own controller.
The right choice depends on your starting point.
What Zero Trust does not replace
Adopting a Zero Trust architecture does not exempt you from the rest. Strong authentication (MFA) remains the foundation: if your IdP is compromised, the Policy Engine can no longer do its job — it is the single point of failure in any ZTA. Endpoint security is the second leg: an infected machine that passes posture checks because the agent itself is compromised still benefits from Zero Trust. Encryption at rest complements the in-transit encryption that Zero Trust enforces.
Finally, Zero Trust does not replace detection. It massively reduces the attack surface by eliminating implicit trust, but it does not detect an attacker who has obtained legitimate credentials. Zero Trust and XDR/EDR are complementary, not substitutable: the former reduces access paths, the latter detects what still gets through.
The verdict
If you manage an infrastructure of fewer than 100 machines and your priority is eliminating open ports and the VPN, start with Tailscale. Deployment takes literally three commands, integration with your existing IdP is immediate, and the free plan covers the core needs of an SMB or a personal lab. The day you need DNS filtering, DLP, or browser isolation, add Cloudflare Zero Trust alongside it — the two complement each other without stepping on each other’s toes.
If you operate a regulated, multi-cloud, or air-gapped infrastructure, and you want to embed Zero Trust into your applications, OpenZiti is the only solution that offers an SDK and a self-hosted controller. The learning curve is real — expect several days of deployment and tuning — but that is the price of an architecture where your services are literally invisible on the network.
If you have neither the time nor the expertise to operate anything and you want a turnkey replacement for your legacy VPN, Cloudflare Zero Trust is the most direct path: install cloudflared on your servers, connect your IdP, and close every inbound port.
Whatever the option, the starting observation is the same: your firewall no longer protects anything, and putting it back at the center of your security strategy in 2026 is a diagnostic error. The network perimeter has been dead since your applications moved to the cloud and your users moved to their living rooms. Zero Trust is the only architecture that takes this reality into account.
References
- NIST SP 800-207 — Zero Trust Architecture, NIST, August 2020.
- NIST SP 800-207A — A Zero Trust Architecture Model for Access Control in Cloud-Native Applications, NIST, 2024.
- M-22-09 — Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, Office of Management and Budget, January 26, 2022.
- BeyondCorp: A New Approach to Enterprise Security, Google Research, 2014.
- BeyondCorp: Design to Deployment at Google, Google Research, 2016.
- BeyondCorp: The Access Proxy, Google Research, 2017.
- How Tailscale works, Tailscale Blog, March 2020.
- Cloudflare One documentation, Cloudflare, updated April 2026.
- OpenZiti overview, NetFoundry, 2026.
- Zero Trust Architecture — Wikipedia, accessed March 2026.