Zero trust is a journey, not a product: a practical roadmap

Zero trust is one of the most talked-about concepts in cybersecurity, and also one of the most misunderstood. Vendors have rebranded everything from firewalls to identity tools as “zero trust,” creating the impression that buying the right product is enough. It is not. Zero trust is a security philosophy, not a SKU. It assumes that no user, device, or network segment is inherently trustworthy, and it demands verification for every access request, every time.

Start with identity, not firewalls

The most practical starting point for zero trust is identity. Most organisations already have directory services, but few enforce strong authentication consistently across every application. Implementing single sign-on (SSO) and multi-factor authentication (MFA) for every business-critical system is the single most effective step most companies can take. It reduces credential theft risk, simplifies user management, and creates an audit trail that is essential for incident response.

Next, move beyond coarse-grained access control. Role-based access is better than nothing, but it tends to accumulate over time, leaving users with far more permissions than they need. A zero trust approach favours least-privilege, just-in-time access, and regular entitlement reviews. If someone cannot explain why they have a permission, they probably should not have it.

Segment the network, then the workload

Traditional flat networks allow an attacker who compromises one endpoint to move laterally with minimal resistance. Micro-segmentation limits what each workload can talk to, and it is enforced at the identity and workload level rather than by physical topology. Combined with device trust checks, this means that a compromised laptop in a coffee shop cannot automatically reach sensitive production systems, even if the user has valid credentials.

Measure progress, not purchases

The real measure of zero trust is not how many products were deployed, but how the attack surface shrinks over time. We recommend a 12-month roadmap that tracks coverage of MFA, privileged access management, workload segmentation, and logging maturity. Each quarter should deliver a measurable improvement, and each improvement should be validated against realistic attack scenarios. That is how zero trust becomes a journey with a destination, rather than a marketing slide.