A security model that assumes all users and devices are untrusted and requires continuous authentication and authorization.