Zero Trust gets sold as a product, used as an architecture and scored as a maturity level. I read the main definitions, from NIST, CISA, the UK NCSC, US federal policy and six vendors, and asked two things: what do they actually commit you to, and has anyone tested whether meeting those commitments leads to fewer incidents?
The commitments are firmer than I expected. A lot of the statements can be checked directly against a real system: no service reachable without passing a policy check, phishing-resistant MFA required, private services not exposed to the internet. NIST's lab project built 19 example systems and published which of these checks passed and which didn't. The outcome claims are a different matter. Every document also says Zero Trust reduces breaches, lateral movement or risk, and none of the 22 such claims I sampled gives a measure, a baseline or a study. NIST says itself that measures of success will also need to be developed, and several vendor pages go further than the standards, one calling lateral movement structurally impossible without evidence.
For parts of it the outcome evidence is actually good. MFA and risk-based login checks have large studies showing far fewer account takeovers, though the companies selling them ran the studies, and network segmentation cut an emulated attack from 16 compromised machines to 1 in a vendor-paid test. In one independent government red-team test, segmentation between sites didn't stop the testers moving across the network, though an MFA prompt kept them out of one of the two most sensitive systems. I found no independent study comparing organisations with and without a Zero Trust architecture as a whole, and the US government audits checked compliance rather than outcomes.
So the commitments are testable and have been tested for function, while the claimed outcomes of the architecture as a whole are unmeasured. I'd keep deploying strong authentication and segmentation, because those parts have evidence behind them, and treat Zero Trust labels and maturity scores as evidence of configuration rather than of fewer incidents.