> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safesquid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Zero-Trust Web Security

> Why Layer 7 is the decisive battleground for enterprise security and how to navigate the Zero-Trust Web Security concept set.

# Threats hide in trusted pathways

Modern web applications execute complex business logic across multiple Layer-7 runtimes inside encrypted sessions. Every API call, every file upload, every OAuth token exchange happens inside a TLS tunnel. This execution surface is what adversaries exploit deliberately — not because perimeter controls are weak, but because perimeter controls cannot see inside the envelope.

Traditional security controls — network firewalls, DNS filters, URL-category engines — operate below Layer 7 and see only the envelope of traffic. Source IP, destination IP, port, and domain name are the only attributes evaluated at the network layer. Payload content is opaque. A request to `drive.google.com` carrying 40,000 customer records and a developer syncing a project produce an identical network envelope — the distinction exists only in the HTTP body. A newly registered credential-harvesting kit and a legitimate financial services site are envelope-identical until the domain accumulates a reputation signal — which arrives hours to days after the first attack.

The enforcement gap is not a configuration gap. The gap is a structural limitation. Controls that operate below Layer 7 cannot enforce Layer-7 policy — and every serious web threat today operates at Layer 7.

The business consequence is direct: a single undetected exfiltration incident averages \$4.44 million in breach costs ([IBM Cost of a Data Breach 2025](https://www.ibm.com/reports/data-breach)), triggers regulatory penalties under GDPR, HIPAA, and PCI-DSS, and generates reputational damage that outlasts the breach itself. Organisations that suffer these outcomes are not unaware of security — those organisations are underprotected at the layer that matters.

## Reading path

Work through this series in order, or jump to the topic that matches your evaluation task.

1. [Legacy enforcement gap](/blog/2026-05-23-Legacy-Enforcement-Gap) — why firewalls, endpoint agents, and DNS-only controls fail at the web perimeter
2. **Kill-chain threat catalog** — eleven Layer-7 patterns mapped to [MITRE ATT\&CK](https://attack.mitre.org/):
   * [Initial access](/blog/2026-05-23-Initial-Access-Threats)
   * [Execution](/blog/2026-05-23-Execution-Threats)
   * [Command and control](/blog/2026-05-23-Command-and-Control-Threats)
   * [Exfiltration and policy violation](/blog/2026-05-23-Exfiltration-Threats)
3. [Zero-Trust principles](/blog/2026-05-23-Zero-Trust-Principles) — five architectural principles for the web perimeter
4. [Trust algorithm](/blog/2026-05-23-Trust-Algorithm) — dynamic trust scoring and shared inspection context
5. [Adoption criteria](/blog/2026-05-23-Adoption-Criteria) — when Layer-7 Zero-Trust enforcement applies, and next steps toward deployment

## Related posts

* [What is SafeSquid SWG](/architecture/what_is_safesquid_swg) - product architecture and how SafeSquid implements Zero-Trust web controls.
* [Getting Started](/getting_started/welcome) - deploy and validate SafeSquid in production.
* [Legacy controls leave a structural enforcement gap](/blog/2026-05-23-Legacy-Enforcement-Gap) - the first stop in the Zero-Trust series reading path.