For twenty years we built networks like castles: a high wall (the firewall) and a drawbridge (the VPN) that came down with the right password. Inside, total trust. That model worked while everything lived inside the building. Today half of your applications are in the cloud, your team works from anywhere and your suppliers connect to your systems every day. The castle no longer has walls.
The technical problem is simple to describe and expensive to suffer: when an attacker obtains a valid credential, the perimeter model treats them as one of the family. They can move from server to server, escalate privileges and study your operations for weeks without setting off a single alarm. Modern attacks almost never break the wall. They come in through the door.
Zero Trust reverses that logic. And it is worth saying from the start: it is not a product you buy and install in an afternoon, however some vendors' marketing paints it. It is an architecture decision. In this article I explain how we approach it in practice, in phases and without rebuilding the network.
What really changes with Zero Trust?
The idea fits in one line: no access is trusted just because it comes from inside. Every request is verified: who you are, what device you are coming from, what state that device is in, what resource you want to access and whether that access makes sense at that time and from that place. Verification doesn't happen once at entry. It happens all the time.
If you are looking for the complete conceptual foundation, our blog has a guide on what Zero Trust is. The reference standard is NIST SP 800-207, which defines the architecture without committing to any vendor. Here I am interested in what comes after the theory: putting it into practice.
Traditional perimeter and Zero Trust, side by side
| Aspect | Traditional perimeter | Zero Trust |
|---|---|---|
| Starting assumption | What is inside is trusted | Nothing is trusted without verification |
| Verification | Once, at entry | Continuous, on every access |
| Remote access | VPN with broad network access | Targeted access to the required application |
| Stolen credential | Unrestricted lateral movement | Damage limited to the authorized resource |
| Internal visibility | Limited: internal traffic is rarely inspected | Every access is logged and auditable |
Where to start without rebuilding the network?
Here is the most common misperception: believing that Zero Trust requires tearing down what has been built. In practice, it is implemented in phases, and the first ones build on what you already have.
Phase 1. Identity. It is the new perimeter and where the biggest immediate return lies: MFA on all access (not only email), cleanup of orphaned accounts and a review of privileges. Almost no company needs to buy anything for this phase. It needs to put it in order.
Phase 2. Devices. You cannot decide whether an access request is healthy without knowing the state of the device it comes from. A real inventory and endpoint protection with EDR, to assess device posture before granting access.
Phase 3. Segmentation. Split the network into business zones: critical servers, users, guests, and the industrial side if there is one. The firewall that guards the perimeter is still necessary; segmentation keeps it from being your only defense when something gets past it. You don't need to microsegment every application on day one; just by preventing a compromised device from seeing the whole network, you have already changed the game.
Phase 4. Continuous monitoring. Zero Trust produces a huge advantage: every access leaves a trail. That trail is only worth something if someone looks at it. Connecting those logs to a SOC 24/7 turns the architecture into early detection.
CISA publishes a Zero Trust maturity model that is useful for locating where you are and what comes next. The complete roadmap usually takes 18 to 36 months in a mid-size company, but risk starts to drop from phase 1.
The mistakes I see repeated
The first: buying “Zero Trust in a box.” No single product gives it to you. Be wary of any proposal that doesn't start by asking about the state of your identity.
The second: starting with the most complex part. Fine-grained application microsegmentation is the advanced phase, not the entry point. I have seen projects stalled there for months while accounts without MFA remained open.
The third: declaring yourself Zero Trust after enabling MFA. Without continuous verification, device posture and access logging, that is not a change of model. It is a stricter login.
The right question
The question is not “should my company adopt Zero Trust?” but “what phase am I in today, and which one comes next?” If you don't have the answer, a free security assessment is a concrete way to get it: you come away with a map of your identity, your devices and your segmentation, and with phase 1 defined.
Trust, in security architecture, is no longer a location. Now it is earned with every access.
Frequently asked questions
What is the Zero Trust model and how is it different from traditional security?
Zero Trust is a security model in which no access is considered trustworthy simply because it comes from the internal network. Every request is verified continuously: who you are, what device you are connecting from, what state that device is in and whether the access makes sense at that moment. It is not a product you install once; it is a way of designing the entire architecture, with the NIST SP 800-207 standard as a reference.
How do I start implementing Zero Trust in my company without rebuilding the network?
Start with identity, which is where the benefit shows up fastest: enable MFA on all access, remove orphaned accounts and review who has excessive privileges. Then come devices (inventory and endpoint protection), network segmentation by zones and continuous monitoring. Most companies can cover the first phase with what they already have, without buying new tools.
How long does it take to implement Zero Trust in a company?
In a mid-size company, the complete journey usually takes between 18 and 36 months, because the model is deployed in phases rather than all at once. The good news: risk starts to drop from the first phase, when you put identity in order and enable MFA on all access. The CISA maturity model helps you locate where you are and what step comes next.
What are the most common mistakes when implementing Zero Trust?
The three most frequent: believing that a single product gives you Zero Trust (there is no boxed version), starting with the most complex part, such as microsegmenting applications, instead of first putting identity in order, and considering yourself covered just by enabling MFA, without continuous verification or access logging. If you don't know what phase your company is in, ZetTateK offers a free security assessment to define it.
