Ask ten security teams what zero trust means and you will get ten different answers. One describes a firewall rule, another a vendor logo, a third an organisational chart. Underneath the noise, the idea is simple: stop deciding whether someone is safe based on where they sit on the network, and start deciding based on who they are, what device they are using, and what they are trying to reach. Everything else is implementation detail.

The Perimeter Was Never a Real Wall

Classic enterprise security borrowed its shape from a castle. A hardened edge, a VPN for remote staff, and a soft, flat interior where anything already inside was treated as friendly. That worked when the servers lived in one data centre, the laptops were company-owned, and the applications were yours.

None of those assumptions survived. Applications moved to SaaS, workloads moved to cloud providers, contractors and personal phones joined the party, and a growing share of work happens off any network you control. The castle kept its walls but lost its inside.

The failure mode is well known. An attacker phishes one laptop, steals a session token or cracks a weak password, connects through the VPN, and is then free to move sideways. One compromised endpoint becomes a ransomware incident because the interior offered no friction. Zero trust is a direct answer to that lateral movement.

What Zero Trust Actually Requires

Zero trust is a set of design choices, not a single control. Most mature implementations end up looking like this:

• Every request gets evaluated. Identity, device posture, location, time, and the sensitivity of the resource are all part of the decision — for internal users and external ones alike.
• Least privilege, granted briefly. People get the access they need for the task in front of them, ideally approved just in time and expired automatically, rather than standing admin rights held for years.
• Assume breach. Design so that one compromised account or laptop is a contained problem, not a key to the estate.
• Segment what matters. Production databases, finance systems, and domain controllers should not be one hop away from an intern's inbox.
• Continuous verification. Authentication is a moment; authorisation should be an ongoing judgement that can be revoked the second signals change.
• Log the decisions. If you cannot explain why a request was allowed, you cannot tune the policy or investigate what went wrong.

The practical shift is that trust stops being a location and becomes a calculation that runs on every connection.

Five Misconceptions Worth Retiring

"Zero trust means trusting nobody"

It means not trusting the network. Colleagues still need usable systems, and a programme that treats employees as suspects will be worked around within a month. The target is verification, not suspicion.

"It is a product you buy"

Vendors sell useful components — identity providers, access brokers, endpoint agents, segmentation tooling. None of them is the architecture. Buying three platforms without a policy model gets you three dashboards and the same flat network.

"MFA everywhere is zero trust"

Multi-factor authentication is a prerequisite, not the finish line. A phished session cookie can sail past MFA entirely if nothing checks device state or the sensitivity of what is being accessed.

"You can switch it on over a weekend"

Zero trust is a migration. It lands in slices: this application, this user group, this data set. Teams that announce a big-bang cutover usually roll it back.

"It is only for large enterprises"

A fifty-person company has fewer systems and can move faster. The first steps — strong identity, no shared admin accounts, sensible segmentation, real logging — matter at any size.

Why It Matters More Than It Did Five Years Ago

Credentials are now the main currency of intrusion, and identity systems are the control plane for everything else. When one stolen token can read mail, reach code repositories, and approve payments, the access decision is the security control.

Zero trust also makes incidents smaller. Organisations that have segmented their estate and moved to per-request authorisation typically face containment instead of a full-scale emergency, because an attacker who lands on a workstation finds a series of separate doors rather than an open floor plan. It helps with auditors, too: insurers and regulators increasingly want to see how access decisions are made and evidenced.

Your First Steps, in Order

1. Inventory reality. List the identities, devices, applications, and data stores you actually have, including the SaaS tools bought on a company card. You cannot protect what nobody has written down.
2. Pick one high-value, low-friction target. Administrative access to production, or third-party and contractor access, are good first candidates — limited user counts, obvious risk, clear success criteria.
3. Fix identity fundamentals. Unique accounts, phishing-resistant MFA for admins, conditional access policies that consider device compliance, and no shared credentials.
4. Map the data flows. Trace who talks to what, then place enforcement points between the tiers that matter. Start with the shortest, riskiest paths.
5. Turn on the telemetry. Centralise authentication, endpoint, and network logs. Write a handful of detections you will actually triage before adding more.
6. Write policy down. Codify access rules so they are reviewable, versioned, and testable instead of living in one engineer's memory.
7. Review quarterly. Remove stale accounts and entitlements, and check whether the pilot controls are still doing what you assumed.

Start With One Door, Not the Whole House

Pick a scope you can finish, measure it honestly, and expand from there. Expect friction — someone will lose a shortcut they liked, and their complaint is useful feedback about your design, not an argument against the strategy. Publish a simple explanation of what is changing and why, so people understand the request for a second factor or a fresh approval.

Above all, avoid the trap of treating zero trust as a procurement project. The organisations that get value from it are the ones that changed how access decisions are made, then went shopping for tools to support that model. Choose one door, verify every request through it, and repeat until the flat interior is gone.

Photo: panumas nikhomkhai / Pexels