Zero-Trust Cloud Access Gateway

Policy model

Trust threshold for this resource 0.70

Compromised-device rate (stolen creds) 15%

Request rate 6/s

Live counters

Granted

Denied

Breaches (compromised → granted)

Avg trust score

–

How it works

A legacy perimeter model trusts the network, not the request: once a device is "inside" the corporate VPN it is waved through, no matter what condition it's in. Zero-trust access control drops that assumption — every single request is scored on its own merits, whether it comes from the office LAN or a coffee-shop Wi-Fi.

trustScore = 0.40·identityVerified
           + 0.35·devicePosture(1 − malwareFlag)
           + 0.25·(1 − behaviorAnomaly)

Zero-Trust:  allow  iff  trustScore ≥ threshold(resource)   — every request
Perimeter:   allow  iff  insideNetwork  OR  trustScore ≥ threshold   — inside is a free pass

Mode toggle — Zero-Trust evaluates identity, device posture and behavior on every request regardless of source; Perimeter auto-grants anything already "inside," including a compromised inside device.
Trust threshold — how strict the policy engine is for this resource; a higher bar blocks more marginal requests but also increases false denials.
Compromised-device rate — the share of "inside" requests actually coming from a device with stolen credentials or malware; these are the ones a perimeter model cannot see.
Request rate — how many access attempts per second the four lanes generate.

Real-world relevance: this is the core shift smart-cloud platforms made after repeated breaches showed that "inside the firewall" is not a security boundary — continuous identity and device verification (often paired with policy-as-code and continuous compliance scanning) closes the gap a compromised insider or stolen VPN credential leaves wide open.

ZERO-TRUST

Verified employee Verified, remote / VPN Compromised device (inside) Attacker (no credentials)