# Zero Trust Architecture

> Source: https://netray.co/glossary/zero-trust-architecture
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Glossary

## Short answer

Zero trust is a security model that assumes no user, device or network location is trusted by default. Every request is verified for identity, device health and authorization, and access is limited to the minimum needed.

## Aliases

- zero trust
- ZTA
- zero trust security ERP

## Category

compliance

## Full Definition

Zero trust replaces the older castle-and-moat idea, where anything inside the corporate network was trusted. Its core principles are to verify explicitly, use least-privilege access, and assume breach. NIST describes it in Special Publication 800-207, and US federal guidance has pushed contractors toward it.

For an ERP this has concrete meaning. Users reach the application through an identity-aware proxy or VPN-less access gateway with MFA, not by being on the plant LAN. The database server is not reachable from user workstations, only from the application tier. Integration accounts have narrow, rotated credentials. Admin access is just-in-time and logged. Legacy plant-floor and ERP servers sit in their own network segments.

On-prem ERPs are often flat networks with old service accounts, shared admin logins and open database ports, so zero trust is a program of incremental steps rather than a product: inventory identities, enforce MFA, segment the network, remove standing admin rights, then monitor. Cloud ERPs shift some of this to the vendor, but identity, roles and data export still belong to the customer.

It applies equally to AI. An AI assistant that queries the ERP should authenticate as a defined identity, receive only the data the asking user may see, and have its queries logged. Private model hosting inside the network boundary removes one outside trust relationship entirely.

## Why It Matters

- Ransomware and credential theft usually spread by moving laterally through trusted internal networks, which segmentation and verification limit.
- Defense and aerospace supply chains increasingly ask for zero-trust-aligned controls in contracts and questionnaires.
- It forces a real inventory of service accounts and integrations that often hold excessive ERP rights.
- It gives a structure for governing AI agents, which are new non-human identities touching sensitive data.

## In Practice

A job shop with an on-prem ERP moves from a flat network to three segments: users, application servers and database. It puts remote access behind MFA, removes the shared domain admin login used by the ERP service, and limits the database port to the application server. The project is spread over a quarter and mostly uses existing firewall and directory features.

## Faq

### Is zero trust a product I can buy?

**Answer:** No. It is an approach built from identity, device, network and monitoring controls. Vendors sell components, but the model is a way of designing access.

### Does zero trust mean moving the ERP to the cloud?

**Answer:** No. It can be applied to on-prem, hybrid or cloud ERP. What changes is how access is verified and how the network is segmented.

### Where should a manufacturer start?

**Answer:** Inventory identities and service accounts, enforce MFA for all remote and admin access, then segment the ERP database and application servers from general user networks.

## Search terms

zero trust ERP, zero trust architecture, NIST 800-207, ERP network segmentation, ERP security model, least privilege ERP, zero trust manufacturing, what is zero trust

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json