Older security models trusted anything inside the company network and guarded only the perimeter. Once an attacker slipped past the wall, they could move freely. Zero trust drops that assumption: no request is trusted because of where it comes from, and every access is checked on its own merits.
In practice that means verifying identity, device health and permissions for each request, and granting only the minimum access needed. It is more work to set up, but it limits how far a single compromised account or device can reach.