BeyondCorp

BeyondCorp is a security framework developed by Google that reimagines enterprise access by removing the assumption of trust from the network perimeter. Rather than relying on a VPN to grant access to internal applications, BeyondCorp uses identity, device posture, and user context to determine whether a given user should be allowed to access a resource. Access decisions are made at the application layer and are enforced by a software-defined perimeter that sits between users and services, regardless of their location or the network they use.

The model embodies core zero-trust principles: never trust, always verify; operate on least privilege; and assume breach. It relies on strong authentication, continuous authorization, device health checks, and policy-driven access controls. Enterprises integrate identity providers, device management, and risk signals to build dynamic access rules that apply to individual users and devices rather than to entire networks.

Originating at Google in the late 2000s as a practical response to mobile work and expanding cloud usage, BeyondCorp was publicly described in academic and industry literature and has influenced subsequent zero-trust implementations. In industry terms, it helped to popularize the idea of a software-defined perimeter and served as a precursor to commercial zero-trust offerings, including Google's BeyondCorp Enterprise. The concept remains a reference point in discussions about cloud-first, perimeterless security architectures.