Google Spent Years Building Zero Trust Foundations

Google spent several years building most of the foundations for BeyondCorp, a security model that makes access decisions based on users and devices. The company was still improving its implementation in June 2019. Google advised other organizations to start small and expand only after reliability had been verified.

Related: Black October: Many attacks had been underway for months

The situation at Google

Before BeyondCorp, Google protected its internal systems with a network perimeter. This is the traditional approach in which the corporate network is treated as a trusted zone and employees connect from outside via a VPN, an encrypted tunnel into the corporate network.

Looking back in June 2019, Google attributed the overhaul to productivity problems with VPN access, growing cloud use and vulnerable or compromised devices inside the perimeter. Its answer was BeyondCorp, Google’s implementation of Zero Trust. The term describes a model that grants no inherent trust to the internal network.

As of December 2014, BeyondCorp authenticated, authorized and encrypted enterprise access based on device health and user credentials. Network location, the basis of the perimeter, was irrelevant to that decision.

Migration timeline

The migration was still underway in December 2014. Fat-client applications using proprietary protocols remained a challenge. These locally installed programs communicate with their servers over vendor-specific channels. Google counted them among a long list of remaining workflows.

In summer 2017, Google described the rollout as a series of stages. It began with a local pilot and extended to riskier workflows and remote locations. Google migrated business-critical workflows only after the earlier stages had succeeded.

Google took stock in June 2019. The company had spent several years building most of the foundations. At that point, Google was still improving the implementation.

Decisions and leadership support

Early in the project, Google secured support from its leadership. Throughout the project, the company repeatedly reassessed that support.

A second decision concerned the underlying data. Unreliable employee and device data could lead BeyondCorp to make incorrect access decisions and increase vulnerability. Google cleaned up its data before making consequential changes.

According to InformationWeek in April 2016, Google struggled with faulty device identifiers and inventory data that became outdated after repairs. Inventory data consists of entries in a company’s device directory. Google responded with improved workflows, automated input checks and duplicate recording modeled on double-entry bookkeeping.

Results and operational impact

In the months before summer 2017, BeyondCorp accounted for 0.3 percent of all issues handled by Google’s technical support team. At Google, the lengthy implementation thus combined gradual expansion with a limited share of migration-related support cases.

The model increased the importance of central infrastructure. Because every request passed through these services, Google’s central BeyondCorp systems had to operate reliably and remain resilient worldwide. Disruptions affected employee productivity.

Lessons for CISOs in the DACH region

Google’s experience and recommendations from Google and the National Institute of Standards and Technology (NIST) offer four lessons for security leaders in Germany, Austria and Switzerland.

• Planning horizon. Google spent several years building most of the foundations. By that measure, a Zero Trust program belongs in the budget and roadmap as a multiyear project.
• Leadership support. Google secured leadership support early and revisited it throughout the project. For an initiative of this duration, it makes sense to review that support regularly within the program.
• Inventory before rules. In its August 2020 recommendations, NIST, the US standards institute, calls for an inventory of the organization’s environment before introducing Zero Trust. Combined with Google’s experience of unreliable employee and device data, this points to cleaning up inventory and identity data before building access rules on them.
• Start small. Google recommended starting with a small number of resources, applications, users and devices, then expanding once reliability is confirmed. In its own rollout, business-critical workflows followed successful earlier stages, a pattern applicable to programs in the DACH region.

Frequently asked questions

Each question is collapsed. Tap to reveal the answer.

How did Google handle workflows that were not yet compatible with BeyondCorp?

By December 2014, Google had established a process for temporary migration exceptions. Users could submit workflows that were not yet compatible with BeyondCorp, subject to the necessary approval.

What should an organization inventory before introducing Zero Trust?

In its August 2020 recommendations, NIST advised organizations to identify and catalog devices and other resources, users, business processes, traffic flows and dependencies beforehand. NIST considers this inventory a foundational capability before implementation.

Does Zero Trust completely replace the traditional perimeter?

In August 2020, NIST expected most enterprises to operate a hybrid of Zero Trust and perimeter-based methods indefinitely. NIST recommended a gradual transition.

Image source: AI-generated (November 2026)

Translated from the German original using artificial intelligence. The German version is authoritative.