Embedding Zero Trust in the cloud requires continuous validation at every stage of an application or API interaction. Once access to an application has been verified and granted, the content within the transaction must be inspected to determine it is free of any malicious activity, then only the transaction should be authorized.

The Zero-Trust approach is crucial when verifying the transaction, rather than implicitly trusting the content in the transaction. Adversaries use allowed communications to execute the most common web application attacks like SQL injection and cross-site scripting (XSS) as well as recent attacks including Apache log4j exploit and Cobalt Strike command-and-control (C2) framework. Organizations adopting a Zero Trust architecture should consider verifying every transaction to increase their defenses against malicious activity within content.