Abstract: A monitoring application is configured to model access events in which elements of a network access a network asset. The monitoring application can receive inputs to identify elements that are authorized to access a particular asset, and can define a trust zone including such authorized elements, including the asset. The monitoring application receives log data from which it identifies access events, including the identities of elements involved in each access events. For access events in which sources that are not part of a trust zone access an asset that is part of the trust zone, the monitoring application can generate a trust zone violation alert prompting IT staff to determine whether network security has been breached, whether the network security architecture should be modified, or whether the model should be updated.