Zero-trust replaces perimeter-based security. Every request is authenticated and authorized regardless of source. For law firm client portals with sensitive data, zero-trust principles (MFA everywhere, least-privilege access, continuous verification) are the right mental model.