Picture this. You manage security for a government agency or large corporation and you need a reliable way to protect employees from phishing on mobile devices. You will learn what Zero Trust means for web links, how it differs from threat detection, what a Cloudflare and iVerify announcement really does, and why preserving the definition of Zero Trust matters for customers and vendors alike.
Many readers will see the iVerify and Cloudflare announcement and assume it represents a major step forward for Zero Trust security and protection against phishing-led fraud, cyberattacks and espionage. It sounds impressive. Yet beneath the language lies a dangerous misunderstanding of what Zero Trust really means, and that misunderstanding could lead government agencies and companies to place trust where it isn’t earned.
Zero Trust was introduced by John Kindervag at Forrester Research in 2010 as an upgrade to the old trust based security model. The principle is simple: never trust anything by default. Always verify. It became a US government mandate because traditional security failed to stop attackers who exploited assumptions of trust. But when vendors apply the term to systems that still rely on threat based intelligence, they’re not practising Zero Trust at all.
US government mandate for zero trust architecture
The United States government has made Zero Trust a national cybersecurity priority. Through Executive Order 14028 and the Office of Management and Budget’s memorandum M-22-09, all federal agencies are required to adopt a Zero Trust Architecture. This mandate directs agencies to treat every user, device, network, and application as untrusted until verified, moving away from the outdated assumption that anything inside a network perimeter can be trusted.
The Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Defense have both issued detailed Zero Trust strategies and maturity models to guide implementation. Federal agencies were instructed to meet core Zero Trust goals by the end of fiscal year 2024.
By formally mandating Zero Trust, the US government has set a global benchmark for modern cybersecurity. It recognises that identity, access, and verification must be continuous, data-centric, and independent of physical location or network boundaries. This shift signals a clear expectation that all organisations handling sensitive data or supporting government systems should align with Zero Trust principles to reduce risk and strengthen digital resilience.
The problem with false confidence
Cloudflare’s integration with iVerify uses Protective DNS and threat blocklists to stop known malicious destinations. This is the same approach that’s been around for two decades. It depends on databases of previously identified domains. Those lists can only block what’s already known. Any new, unclassified domain will slip through. This isn’t Zero Trust. It’s reactive security with a modern name.
Zero Trust for phishing protection means assuming every web address is untrustworthy until it’s been explicitly verified as legitimate. That’s the foundation of MetaCert’s model, pioneered in December 2017. When an organisation applies this principle, it authenticates verified addresses each time someone tries to open, share, or send them. It doesn’t depend on whether a domain appears on a blocklist. It depends on real verification.
Two models that look the same but aren’t
The difference between detection and verification may sound small, but it determines whether individuals, families, and organizations are safe or exposed. Threat detection tries to catch known dangers after they appear. Zero Trust verifies what can be trusted before any connection occurs. One relies on pattern matching and probability. The other relies on confirmation. The two models can’t be combined because they operate on opposite assumptions.
It’s like comparing a manual car with an automatic. Both will get you to your destination, but their gearboxes are built differently, operate differently, and follow completely different design principles. The same applies here. Threat detection and Zero Trust may aim for the same outcome, yet they are conceptually distinct. Trying to merge them doesn’t create a stronger defence. It creates confusion.
Why the definition must be protected
The iVerify and Cloudflare announcement repeats a familiar pattern: treating threat blocklists as if they’re equivalent to Zero Trust. But the goal here is to educate, not to single out companies. If the meaning of Zero Trust becomes diluted, customers will be misled. Everyone who builds, buys, or regulates security must protect the definition so people understand what they’re actually buying. Are they buying a car with an automatic or a manual gearbox? Does it take petrol or is it electric? Are they buying threat-based security or true Zero Trust?
This isn’t about promoting one company over another. It’s about protecting the integrity of the concept itself. If the term Zero Trust continues to be diluted, customers won’t know what they’re actually buying. When people think they’re purchasing an automatic but receive a manual, they’re unprepared for how it truly operates. In security, that confusion doesn’t just waste time. It creates vulnerability.
Unless the security industry moves away from threat-based detection and fully embraces a Zero Trust approach, cybercrime will continue to rise from $1 trillion a year to an estimated $15 trillion by 2029. Phishing will remain behind nine out of ten attacks, and each new year will again be recorded as the worst yet. But there’s reason for optimism. The shift has already begun. Organisations adopting true Zero Trust models are proving that prevention works and that verified trust can make the internet safer for everyone.
Which would you trust more? A system that depends on recognising past attacks, or one that proves what’s legitimate?
