The traditional model trusted anything inside the network perimeter. Remote work and cloud services removed the perimeter, which left the trust assumption without anything to stand on.
The working definition
Every request is authenticated and authorised on its own merits, whether it originates in the office or a coffee shop. Access is granted narrowly and reviewed rather than assumed from network location.
Where smaller organizations start
Multi-factor authentication everywhere, conditional access based on device health, and least-privilege access reviews cover most of the practical benefit. None of these require an enterprise budget, and each one closes a path that attackers use routinely.
