A Before-and-After Effectiveness Assessment of Zero Trust Adoption Using a Risk-Adaptive Score-Based Evaluation Model

Abstract

This study proposes a risk-adaptive, score-based evaluation model to quantitatively measure security effectiveness before and after the implementation of a Zero Trust security framework. Prior Zero Trust studies have mainly relied on checklist-based approaches that focus on conceptual architectures or maturity levels, making it difficult to objectively assess actual security improvements after deployment. To overcome this limitation, the proposed model combines scoring of individual security controls with risk-weighted factors, and dynamically adjusts evaluation results in response to changes in threat levels. This enables numerical comparison and analysis of security performance attributable to Zero Trust adoption, rather than a simple binary assessment of implementation. The model is particularly suitable for high-security environments, such as the public and defense sectors, where it can support policy decision-making, performance management, and security investment effectiveness analysis. By providing a structured and quantitative evaluation framework, this study offers an empirical basis for assessing the effectiveness of Zero Trust security implementations.