The three levels of Zero Trust

The short answer

Security architectures answer one question before all others: what does an attacker get when a control fails? Answered honestly, three levels appear — and almost all business software sits at the middle one.

• Level 1 — Perimeter. Trust the network. Everything inside the firewall is treated as friendly.
• Level 2 — Zero Trust Access. Verify every request. The server still holds the keys.
• Level 3 — Cryptographic Zero Trust. The server holds no keys. Compromise yields ciphertext.

The jump from Level 1 to Level 2 is the one the industry has spent a decade making. The jump from Level 2 to Level 3 is the one almost nobody has made — and it is the only one that changes the outcome of a breach rather than its likelihood.

Level 1: Perimeter

The classic model: a hard shell around a soft centre. Firewalls, a VPN, a corporate network. Authenticate once at the edge, and from then on you are inside — and inside is trusted.

Its failure mode is famous. One phished account, one exposed service, one contractor's laptop, and the attacker is inside the trusted zone with room to move sideways. The breach reports of the last twenty years are largely the story of this model's collapse.

Level 2: Zero Trust Access

Zero Trust was the correct response. Stop treating location as proof. Verify every request on its own merits: who is asking, from what device, in what state, for which specific resource — and re-check continuously rather than once at the door.

This is genuinely better, and it is the model behind NIST SP 800-207 and the maturity models built on it. Identity becomes the control plane. Privilege is narrowed to the task. Lateral movement gets much harder.

But look closely at what is being verified, and at what sits behind the verification. Every check governs access. Behind all of them, the database is readable, because the service that runs it holds the keys that open it. Encryption "at rest" does not change this: the server encrypts the disk and also holds the key to that disk, which protects you against someone stealing the physical drive and against nothing else.

So the guarantee at Level 2 is conditional: your data is safe for exactly as long as no check is ever bypassed. Every stolen session token, every over-scoped service account, every misconfigured export, every administrator acting in bad faith, and every bug in the verification logic converts directly into readable records. The control is strong, but it is the only thing standing there.

Level 3: Cryptographic Zero Trust

Level 3 applies the same sentence — never trust, always verify — to one more party: the server itself. If the server is never trusted, it cannot be given the keys. And if it does not have the keys, what it stores is ciphertext, to everyone, permanently.

In practice that means keys are derived and held on the client. Data is encrypted on your device before it travels, using authenticated encryption, and the service stores only the sealed result. Sharing happens by wrapping a record's key for another person's public key, so the server passes keys along without ever seeing one in the clear.

The defining property is not which cipher is used. It is key custody: can the operator of the service technically derive a key that opens your records? At Level 3 the answer is no, and that answer holds regardless of who is logged in, what they claim, or which control just failed.

Where this fits with the existing standards

An honest note, because the term matters. "Cryptographic Zero Trust" is our name for Level 3, not a designation from a standards body. NIST SP 800-207 defines Zero Trust, and CISA's Zero Trust Maturity Model organises it into pillars — one of which is data, and it does discuss encryption. So it would be wrong to say the published models ignore data.

What we are pointing at is narrower and, we think, more useful: in real deployments the data pillar is nearly always implemented with keys the operator holds. When that is true, data protection collapses back into access control wearing a different name, and it inherits every weakness of access control. Level 3 names the one property that does not collapse — the operator cannot decrypt — and asks vendors to be graded on it.

How to tell which level a vendor is at

Marketing pages are unreliable here; nearly every vendor now says "Zero Trust" and "encrypted". Four questions settle it, and they are answerable in a single call.

1. Where is the key created — on my device, or on your server? If the answer is the server, the ceiling is Level 2.
2. Can any of your staff, with any level of privilege and any internal tool, display one of my records in readable form? A "yes, but it is tightly controlled and logged" is a Level 2 answer.
3. If you receive a lawful order for my data, what do you hand over — records, or ciphertext? The answer is a direct statement about key custody.
4. What is your account recovery flow? At Level 3 recovery runs through a recovery key you hold, because a provider that can silently restore your data can also silently read it.

That last question is also where the honest trade-off of Level 3 lives. When nobody else can open your data, nobody else can rescue it either. Recovery keys, escrow held by your own organisation, and clear key-management procedures are not optional extras at this level — they are the cost of the guarantee.

Why the third level is worth the work

Levels 1 and 2 are bets on prevention: they lower the probability that something gets through. That is worth doing, and it is not finished — Level 3 does not replace identity, least privilege or monitoring, and a serious system runs all of them together.

What Level 3 adds is a bet on failure: it fixes the cost of being wrong. Prevention has to succeed every time; cryptography only has to hold once the prevention has already failed. That is why it is the only layer whose value goes up on the worst day rather than down.

Zeromatics builds every product at Level 3 — your work is sealed under keys we never hold. But the framework is bigger than any one vendor. If you are buying software that holds confidential records, ask the four questions above of whoever you are buying from, including us.