Zero Trust for Regular People: Personal Security Guide

A Corporate Framework, Pointed Sideways

In 2014, a Google engineering team published a paper called BeyondCorp that fundamentally changed how large organizations think about security. The traditional model had been castle-and-moat: trust people inside the network, distrust people outside, defend the perimeter. BeyondCorp made the radical observation that the perimeter no longer existed in any meaningful sense — employees work from coffee shops, attackers are inside networks all the time, the network's edge had become indistinguishable from its interior.

The alternative they proposed was zero trust. No network gets implicit trust. Every request is authenticated. Every authorization is checked. Every device is verified. The system doesn't care where you are; it cares who you are, what device you're using, and what permissions that combination is granted at this exact moment.

A decade later, zero trust is the dominant corporate security architecture. NIST published SP 800-207 codifying it. Every major cloud provider sells products built on it. It's mainstream enough that you can buy a vendor solution for it.

What almost nobody does is point the same framework at their personal life. The principles port. The architecture is actually easier at human scale than at enterprise scale. And the result is meaningfully better than the ad-hoc "some passwords, some 2FA, hope for the best" approach most people use.

The Core Idea, At Personal Scale

Zero trust at corporate scale is complicated because there are thousands of users, tens of thousands of devices, and millions of resources. Zero trust at personal scale has, by comparison, a handful of users, a handful of devices, and a few hundred resources.

The core idea translates to:

Treat every account, every device, and every relationship as untrusted by default.
Authenticate explicitly, every time.
Authorize based on what you're trying to do right now, not on a one-time "is this person in?" check.
Audit everything. Know who has access to what, and review it.

This sounds heavy. In practice, most of the work is one-time. You set up the architecture, and then it runs.

Principle One: Identity, Not Location

The oldest assumption in consumer security is that being on the home network is a security signal. It isn't. The home network is full of devices you don't control — the smart TV, the baby monitor, the IoT light switch — each of which is a potential pivot point for an attacker.

Zero-trust personal architecture stops trusting the home network. You authenticate the same way whether you're on home wifi or a hotel wifi. The difference, ideally, is invisible. If you ever find yourself thinking "I'll log in to this account without 2FA because I'm at home," you've slipped.

Practical implementation: use a password manager that fills credentials anywhere. Use 2FA on everything, regardless of location. Don't allow your devices to bypass authentication based on "trusted network" rules; the network isn't trusted.

Principle Two: Device Posture

In corporate zero trust, every request includes information about the device making the request. Is it managed? Is it patched? Is it encrypted? Is the user logged in?

At personal scale, you can't enforce device posture against websites you don't control — they don't know whether your laptop is patched. But you can track your own device posture and treat unpatched, unencrypted, or unfamiliar devices as risks.

A few concrete habits:

Keep an inventory of every device that's logged into your accounts. Review the device lists in Google, Apple, Microsoft, and your password manager periodically. Revoke anything you don't recognize.
Enable disk encryption on every laptop. FileVault, BitLocker, or LUKS. No exceptions.
Patch on a schedule. "When prompted" is fine for most users; "never" is unacceptable.
When you replace a device, wipe the old one before disposing of it. The old laptop with your saved passwords in the browser is a future incident.

Principle Three: Authentication Is The Perimeter

In the castle-and-moat model, the firewall was the perimeter. In zero trust, authentication is the perimeter. The question is no longer "can I reach this service?" but "can I prove who I am to it?"

This means the strength of your authentication is the strength of your security. Specifically:

Use a password manager. Reused passwords or memorized passwords are the failure mode this whole framework is designed to prevent. Don't be the soft target.
Use hardware-backed 2FA where possible. A YubiKey or platform-bound passkey is much stronger than SMS or even TOTP apps.
Use phishing-resistant 2FA (passkeys, FIDO2) where possible. SMS 2FA is better than nothing but it's the weakest 2FA tier.
Don't reuse 2FA factors across high-value and low-value accounts. The Twitter account and the bank account should not be guarded by the same TOTP app, or at least not the same phone.

Principle Four: Least Privilege, Continuously

Zero trust corporate systems grant access just-in-time, for just the duration needed, with just the permissions required.

At personal scale, the equivalent is not having more permissions than you need. Specifically:

Don't let websites store credit cards unless you're going to use them often.
Don't allow apps to keep you logged in indefinitely — enable session timeouts where you can.
Don't grant OAuth permissions to apps you don't actively use. Periodically audit your connected apps in Google, Apple, GitHub, etc.
Don't give children admin access to your computer. Don't give yourself admin access on a computer where you don't need it.

Most personal devices and accounts have far more privilege than they should, by default. Trimming is a habit, not a one-time project.

Principle Five: Assume Breach

The single biggest mindset shift in zero trust is the assumption that you've already been breached and are operating in compromised territory.

For an individual, this means:

Don't trust SMS to be private. Don't authenticate via SMS for anything important.
Don't trust email to be private. Use end-to-end encrypted messaging for actually sensitive material.
Assume your phone number can be SIM-swapped. Set up port-out PINs with your carrier.
Assume your password manager can, in extremis, be compromised. Have an out-of-band recovery plan.
Assume one of your accounts will be compromised this year. Have a playbook for what to do when it is.

The last one is the most important. Most people don't have a playbook. The playbook is roughly: change the password, force-log-out all sessions, revoke connected apps, rotate the 2FA, audit recent activity, notify financial institutions if relevant, and document the incident. Knowing this before you need it makes the response much faster.

Principle Six: Audit

The last zero-trust principle is the most underrated. Zero trust corporate systems are obsessive about logging — every authentication, every authorization, every privileged action. The logs are not optional.

For personal accounts, the equivalent is: periodically review the activity logs that your services do keep. Google's account activity. Apple's recent sign-ins. Your bank's recent transactions. Your password manager's audit log.

Most people don't look at these unless they suspect something. Zero trust says: look at them regularly, before you suspect anything. The anomalies you'll catch are the early warnings of compromise. The compromises you don't catch get worse with time.

How This Connects To Estate Planning

The whole framework above is designed to keep your accounts secure while you're using them. The estate-planning extension is the same framework applied to delegation: how do you, having locked everything down zero-trust-style, also make it possible for specific people to access specific things at specific times?

The answer is that the same authentication-as-perimeter discipline applies. Your designated emergency contact's access has to be proven, not assumed. The trigger has to be verified, not implicit. The audit log of who accessed what after your death matters as much as the audit log of your own current activity.

A zero-knowledge deadman switch fits cleanly into this framework. It treats every component as untrusted: the storage holds ciphertext only, the trigger is verifiable, the beneficiary's access is logged. It's zero trust applied to the case where the principal user is no longer around to authenticate.

The punchline is that zero trust at personal scale isn't paranoia. It's normalcy. The amount of work involved is, after the initial setup, less than the amount of work involved in the alternative — which is recovering from breaches you didn't see coming. Done right, the architecture fades into the background, you stop thinking about it, and you become a much smaller target.

Which, given how many of you the internet contains, is the most realistic security goal available.

Killswitch is zero-trust applied to the case you can't authenticate yourself: ciphertext-only storage, verifiable triggers, beneficiary access that's authenticated and logged. The same architecture you'd want at work, scaled to your household. Get started today