Every request uses the same stolen but technically-valid device credential — the certificate itself is never rejected outright. What differs is how much each model checks beyond that credential.
Trust-once (perimeter): the device authenticated successfully once, at network-join time, and is now on the trusted local segment. Every subsequent request from that credential is accepted automatically — the model never looks at where the request is coming from or whether it fits the device's normal pattern.
Zero Trust (per-request): the controller re-evaluates every single request against the credential and contextual signals — expected physical segment, expected behavior pattern, request frequency. A request from the expected context passes; a request from an unexpected context is flagged and blocked, even though the credential itself checks out.
- Try firing a suspicious-context request under trust-once — it always succeeds, because the perimeter never re-checks context.
- Switch to Zero Trust and fire the same suspicious-context request — it gets blocked, despite the identical valid credential.
- The tally on the left keeps score of both models side by side as you fire requests.