The model it replaces is the castle: a hard perimeter, a trusted interior, and a firewall deciding who gets in. That worked while the interior was a building and the users sat in it. It stopped working when the applications moved to other people's data centres, the users moved to their kitchens, and the attacker who stole one password found themselves inside a network that trusted everything inside it. Zero trust is the reply: the network location of a request tells you nothing, so each request has to prove who is asking, from what device, for which resource, and whether policy allows it right now.
What the standard actually says
NIST's architecture document describes zero trust as a set of principles, not a product: all resources are treated as such regardless of location, all communication is secured, access is granted per session, policy is dynamic and uses signals about the user and the device, the enterprise monitors the integrity of everything it owns, and authentication and authorisation are enforced before access. Nothing in that list names a vendor, and most of it can be met with an identity provider, per-application access rules and a habit of logging decisions.
In practice the shift is from network segments to identities. A user does not connect to the office network and then reach the payroll system because they are inside; they authenticate to an identity provider, present a device that meets the policy, and receive access to payroll and nothing else, with the decision re-evaluated when their risk signals change. The hardest part is not the technology. It is cataloguing what the resources are and who should reach each one, which is the inventory work most organisations have deferred for a decade, and which no product performs for them.