The Next Generation of Zero Trust

Gen 1: Built around the perimeter

VPNs and Firewalls were designed to defend the perimeter. Organizations trusted everything inside the network and concentrated on keeping attackers out. Firewalls enforced a boundary; VPNs extended it to remote users.

The model worked when users, devices, and applications largely operated inside a single controlled environment. Its organizing assumption was simple — inside means trusted — and for its era, that assumption was reasonable.

But the explosive migration to the cloud demolished that assumption. As applications, data, and users moved outside the building, the perimeter dissolved. The model's deepest weaknesses became structural:

• The gateway is a visible perimeter that attackers can scan, probe, and target from the open internet.
• Access depends on credentials — usernames and passwords that are routinely phished, stolen, or brute-forced.
• A single compromised credential or misconfigured rule can expose the entire network behind it.
• OT and IoT devices sit unprotected — they cannot run VPN agents and remain exposed on the local network.

Gen 2: Trust moved to the cloud

Generation 2 recognized that the perimeter had dissolved. ZTNA and SDN were developed specifically to address the vulnerabilities of VPNs, and they represent a genuine advance.

Enterprise ZTNA and SDN platforms eliminated perimeter-based trust, enforced continuous authentication tied to identity, and enabled fine-grained access control. "Never trust, always verify" replaced implicit interior trust. But for the majority of organizations, ZTNA and SDNs traded one set of problems for another:

• They rely on centralized cloud control planes. Servers, certificate authorities, and identity providers become high-value targets — a compromise of the vendor's infrastructure is a compromise of every customer.
• They are expensive and complex, typically priced and staffed for large-enterprise budgets.
• They are software-only, and cannot protect OT and IoT devices that can't run agents.
• They create metadata exposure — providers can observe connection patterns, timing, and topology even when payload content is encrypted.

Trust still rests with a third party — now the cloud provider rather than the network perimeter. The organization verifies more, but controls less.

Gen 3: Trust is owned and controlled by the Network Owner.

Faction Networks extend Zero Trust principles beyond networks, users and applications to include infrastructure, OT/IoT devices, data, and AI-enabled operations. It addresses the fundamental challenge of our era: implicit trust no longer is tenable.

Instead of centralizing trust in a vendor's control plane, Generation 3 returns it to the owner. The organization creates and controls its own trust relationships and encryption keys, and the platform routes encrypted traffic without the ability to read it. Its defining properties:

• Zero Knowledge Architecture — the data plane is owner-keyed, so Faction routes your traffic but cannot read it. Faction can't see what you protect.
• Owner-controlled trust — keys and trust relationships are created and governed by the organization, not the vendor.
• No Anonymous. Every device authenticates with a certificate from the network owner — no anonymous or unsigned connections are accepted.
• Invisible by default — no discoverable gateway, port, or attack surface to scan from the internet.
• Hardware-native protection — Pods and Portals extend Zero Trust to OT and IoT devices that cannot run software agents.
• Identity-bound AI governance — every agent is cryptographically bound to a verified identity and accountable beneath the application layer.

Together these properties remove the weaknesses of the first two generations: no perimeter to breach, no public control plane to compromise, and no anonymous foothold inside.