A Valid Login Is No Longer Enough to Establish Trust

For years, enterprise access began with a familiar question: does this person have the right username and password? 

That question still matters. It simply does not tell an organisation enough anymore. 

An employee can have completely valid credentials and still present a security risk. They could be logging in from an unmanaged personal laptop. Their corporate device could be running outdated software. Their credentials could have been compromised and used from an unfamiliar location. 

The identity may be legitimate. The circumstances surrounding the request may not be. 

This is why enterprise access is increasingly moving beyond authentication towards contextual trust. 

Identity remains the starting point. Enterprises already manage employees through identity providers, which makes standards such as SAML and OIDC important for bringing existing identities and single sign-on environments into a Zero Trust architecture. 

The next question is whether the device itself can be trusted. 

Mutual TLS, for example, allows a device to authenticate using a trusted digital certificate. Access can therefore depend on two separate signals: whether the platform recognises the user and whether the request originates from a device the organisation has approved. 

From there, access can become even more contextual. 

Device health, location and behavioural signals can contribute to a trust score that influences how an individual request is handled. The same employee accessing an application from a compliant corporate laptop during their normal working pattern may represent a different level of risk from the same credentials suddenly appearing on an unknown device from an unexpected location.

This changes the nature of enterprise access control. 

Security teams no longer have to reduce every request to a binary question of whether a person is authenticated. They can make access decisions according to the conditions under which that access is being requested. 

The same principle can continue beyond the initial login. 

An identity-aware proxy can evaluate whether that particular user should reach that particular application. Secure tunnels can protect the connection to the resource. DNS filtering can govern where users are allowed to go beyond private applications. 

Each capability answers a different security question, but together they create a more useful definition of trust. 

Who are you? What device are you using? What are you trying to access? Under what conditions should that access be allowed?

We recently worked on a Zero Trust security platform where these questions had to be engineered into the access journey through identity integrations, mTLS device authentication, trust-based policy enforcement, identity-aware access and secure connectivity. 

The broader engineering story shows why modern Zero Trust increasingly depends on combining multiple trust signals into one access decision.