What Zero Trust actually means for a mid-sized business

Zero Trust has been marketed hard enough that the term has started to lose shape. Vendors attach it to firewalls, identity platforms, VPN replacements and endpoint agents, which leaves a lot of businesses assuming it is something they buy rather than something they do.

The principle underneath the marketing

The idea is simple: stop treating the internal network as trusted. Historically, once a device was inside the perimeter it was broadly trusted to reach internal systems. That assumption is what turns a single compromised laptop into an organisation-wide incident.

Zero Trust replaces that with per-request verification. Every access decision considers who is asking, what device they are on, and whether that combination should reach that specific resource — regardless of which network they sit on.

Where a mid-sized business should actually start

Full Zero Trust architecture is a multi-year programme, and most organisations do not need to begin there. The first three moves deliver most of the risk reduction:

Enforce multi-factor authentication everywhere, including on legacy protocols that quietly bypass it. Remove standing administrative privilege so that admin rights are requested and time-bound rather than permanently assigned. Segment the network so that finance, operations and guest traffic cannot reach each other freely.

What to be sceptical about

Any proposal that presents Zero Trust as a single purchase is describing a product roadmap, not a security posture. Ask what the deployment changes about who can reach what, and how that is verified after go-live.