Zero trust security is a model built on one rule: never trust, always verify. No user, device, or connection is trusted because of where it is, not even inside the office network. Every request for access is authenticated, authorized, and checked against policy, every time, using identity, device health, location, and behavior. The traditional approach built a strong perimeter (a firewall) and trusted everything behind it. Zero trust assumes the attacker is already inside, because with remote work, cloud applications, and phished credentials, they often are. It’s not a product you buy. It’s an approach you adopt, and mid-size businesses can get most of the benefit with tools they already own.
In this guide
- Why the perimeter model failed
- The core principles of zero trust
- How zero trust works in practice
- The pillars of a zero trust architecture
- Zero trust vs. VPN
- What zero trust looks like at a mid-size business
- How to adopt zero trust: a phased approach
- Zero trust tools compared
- Common mistakes
- How Sixwatch implements zero trust
- FAQ
- Glossary
Why the perimeter model failed
For twenty years, network security meant a hard shell around a soft center. Employees came to the office, plugged into the network, and were trusted. A firewall kept outsiders out. Remote workers connected through a VPN that put them “inside.”
Three things broke it:
- The perimeter dissolved. Email, files, and applications moved to Microsoft 365, Google, and SaaS platforms. Employees work from home, hotels, and phones. There’s no inside anymore.
- Attackers get inside easily. A phished password, a compromised laptop, or a malicious insider is inside the perimeter with full trust. Once in, they move freely to every server and share. This is how ransomware spreads.
- VPNs became the front door. An exposed VPN with a stolen credential gives an attacker the same trusted network position as an employee at their desk.
Zero trust, formalized by Forrester analyst John Kindervag in 2010 and defined by NIST in Special Publication 800-207, replaces “trusted because you’re inside” with “trusted because you’ve proven who you are, on a healthy device, for this specific resource, right now.”
The core principles of zero trust
- Verify explicitly. Authenticate and authorize every access request using all available signals: user identity, device health, location, application, data sensitivity, and anomalies. Not once at login; continuously.
- Use least privilege access. Users and systems get the minimum access needed, for the minimum time needed. Access to the finance share doesn’t imply access to the HR share. Admin rights are granted just in time and expire.
- Assume breach. Design as if the attacker is already inside. Segment the network so a compromised laptop can’t reach the servers. Encrypt everything. Log everything. Detect and respond fast.
Every zero trust control maps to one of these three.
How zero trust works in practice
An employee opens a file in SharePoint from a coffee shop. Under zero trust:
- Identity: she signs in with a password and phishing-resistant MFA. The identity provider checks whether this login pattern is normal for her.
- Device: her laptop must be company-managed, encrypted, running current patches, with endpoint protection active. A personal or unhealthy device is denied or limited to read-only.
- Policy: conditional access rules evaluate all of it. Finance data from an unmanaged device? Blocked. Normal user on a healthy device from a new country? Step-up authentication.
- Access: she’s connected to that one application, not the whole network. She can’t see servers she has no business with.
- Continuous evaluation: if her device’s protection is disabled mid-session or her account starts behaving oddly, the session is cut.
None of this requires her to be in the office or on a VPN. That’s the point.
The pillars of a zero trust architecture
CISA‘s Zero Trust Maturity Model defines five pillars:
| Pillar | What it means | Key controls |
|---|---|---|
| Identity | Every user is strongly authenticated and continuously evaluated | MFA (phishing-resistant), single sign-on, conditional access, privileged access management, identity threat detection |
| Devices | Only known, healthy devices get access | Device management (Intune, etc.), compliance policies, endpoint detection and response, encryption |
| Networks | The network is segmented and traffic is inspected; location grants nothing | Micro-segmentation, zero trust network access (ZTNA) replacing VPN, encrypted traffic, DNS filtering |
| Applications and workloads | Access is per application, with app-level controls | SSO integration, app-based conditional access, API security, cloud app security brokers |
| Data | Data is classified, protected, and monitored wherever it goes | Classification and labeling, encryption, data loss prevention, access governance |
Plus two cross-cutting capabilities: visibility and analytics (logging and monitoring across all pillars) and automation and orchestration (policies enforced automatically, responses triggered automatically).
Zero trust vs. VPN
| VPN | Zero trust network access (ZTNA) | |
|---|---|---|
| What it grants | A position on the internal network | Access to one specific application |
| Trust model | Trusted once connected | Verified per request |
| Attack surface | The VPN itself is internet-exposed and a top exploitation target | Applications are hidden; no inbound exposure |
| Lateral movement | Possible; user can reach anything on the network | Blocked; user sees only assigned apps |
| Device checks | Usually none | Device health required |
| User experience | Connect, then work; slow with all traffic tunneled | Transparent; apps just work |
VPNs aren’t going away overnight, but ZTNA is replacing them for application access, and the VPN that remains should sit behind MFA and device checks.
What zero trust looks like at a mid-size business
Zero trust is often described in enterprise terms, but a 50-person firm on Microsoft 365 Business Premium already owns most of the pieces:
- Entra ID with conditional access for identity and policy
- Intune for device management and compliance
- Defender for Endpoint / Business for device health and detection
- Phishing-resistant MFA via Authenticator with number matching, passkeys, or hardware keys
- Network segmentation on the existing firewall: separate VLANs for servers, workstations, guests, printers, and IoT
- ZTNA or a modern secure access service in place of an exposed VPN
- Sensitivity labels and DLP for the data that matters most
- Logging to a central place with someone watching it
The gap is rarely tools. It’s configuration, policy, and someone accountable for maintaining it.
How to adopt zero trust: a phased approach
Phase 1 (first 90 days): Identity and endpoints
- Enforce MFA for everyone; phishing-resistant for admins
- Block legacy authentication
- Enroll all devices in management; require encryption and endpoint protection
- Build conditional access policies: MFA everywhere, block unmanaged devices from sensitive data
- Remove standing admin rights; separate admin accounts
Phase 2 (3–6 months): Network and access
- Segment the network
- Replace or protect the VPN with ZTNA
- Inventory applications; bring them under SSO
- Restrict app consent and third-party integrations
Phase 3 (6–12 months): Data and visibility
- Classify sensitive data; apply labels and DLP
- Centralize logging; add detection and alerting
- Implement just-in-time privileged access
- Automate response for common scenarios (disable account on impossible travel, isolate device on malware detection)
Ongoing: review policies quarterly, measure maturity against the CISA model, and expand.
Zero trust tools compared
| Category | Examples | Notes |
|---|---|---|
| Identity and access | Microsoft Entra ID, Okta, Duo | Conditional access is the policy engine |
| Device management | Microsoft Intune, Jamf, Kandji | Compliance policies feed conditional access |
| Endpoint detection | Microsoft Defender, CrowdStrike, SentinelOne | Device health signal and breach detection |
| ZTNA / secure access | Zscaler, Cloudflare Access, Microsoft Entra Private Access, Twingate, Perimeter 81 | Replaces VPN for app access |
| Network segmentation | Existing firewalls (Fortinet, SonicWall, Meraki) with VLANs and policies | Often already owned |
| Data protection | Microsoft Purview, Google DLP | Classification and DLP |
| Logging and detection | Microsoft Sentinel, managed SOC services | Someone has to watch |
For most businesses under 250 employees, Microsoft 365 Business Premium plus a properly configured firewall and a managed security provider covers the first two phases entirely.
Common mistakes
- Buying a “zero trust product.” Zero trust is an architecture; no single product delivers it.
- Starting with the network instead of identity. Identity is the new perimeter; MFA and conditional access come first.
- Trusting managed devices unconditionally. A managed device can still be compromised; health must be checked continuously.
- Leaving legacy authentication and exposed VPNs in place while calling the program zero trust.
- Policies too strict, too fast. Users find workarounds, or leadership demands exemptions. Phase in with monitoring mode first.
- No logging or no one watching it. Verification without visibility is theater.
- Treating it as a project with an end date. It’s an operating model.
How Sixwatch implements zero trust
Sixwatch builds zero trust into managed cybersecurity for businesses across Tampa Bay and Cincinnati, mostly with the Microsoft 365 tools they already license: conditional access policies, device compliance through Intune, phishing-resistant MFA, endpoint detection, network segmentation on existing firewalls, and ZTNA in place of exposed VPNs. We phase it in so users barely notice, and we watch the logs so verification means something.
Founder John Owens brings 25+ years of IT and security experience. Every plan includes a 30-minute emergency remote response and same-day onsite support, and our 5.0 Google rating includes clients whose compromised laptop reached nothing because it wasn’t trusted to.
Book a 15-minute call or request a proposal.
Frequently asked questions
What is zero trust security? A security model in which no user, device, or connection is trusted by default, regardless of location. Every access request is verified using identity, device health, and context before being granted, and access is limited to the specific resource requested.
What are the three principles of zero trust? Verify explicitly, use least privilege access, and assume breach.
Is zero trust a product? No. It’s an architecture and operating model implemented with a combination of identity, device, network, application, and data controls. Vendors sell components, not zero trust itself.
Does zero trust replace a VPN? Zero trust network access (ZTNA) replaces the VPN for application access, granting per-app connections instead of network positions. Where a VPN remains, it should require MFA and device checks.
Can a small business implement zero trust? Yes. Businesses on Microsoft 365 Business Premium already own the core tools: conditional access, Intune, Defender, and MFA. The work is configuration and policy, typically done in phases over 6 to 12 months.
What is NIST 800-207? The NIST publication that defines zero trust architecture, its principles, and deployment models. It’s the reference standard most programs are built on.
How is zero trust different from traditional network security? Traditional security trusts everything inside the network perimeter. Zero trust trusts nothing by default and verifies every request, treating the internal network as untrusted.
What is micro-segmentation? Dividing the network into small zones so that access between them is controlled and a compromise in one zone can’t spread to others.
Glossary
- Conditional access: Policy rules that evaluate identity, device, location, and risk to allow, block, or require step-up authentication.
- Device compliance: A check that a device meets security requirements (encryption, patches, protection) before access is granted.
- Least privilege: Granting only the access required for a task.
- Micro-segmentation: Fine-grained network division limiting lateral movement.
- Perimeter: The traditional boundary between “inside” and “outside” the network.
- Privileged access management (PAM): Controls for admin accounts, including just-in-time elevation.
- Single sign-on (SSO): One identity used across many applications, enabling central policy.
- ZTNA: Zero trust network access; per-application access replacing VPN network access.
Still trusting everything that connects to your network? Book a 15-minute call · Request a proposal