Zero Trust has become one of the most heavily marketed ideas in cybersecurity. Almost every security vendor now describes its products as Zero Trust, and almost every security strategy includes the phrase. Yet when we assess enterprise environments, genuine Zero Trust architectures remain rare. What we more often find is a collection of Zero Trust-branded products layered on top of a network that still implicitly trusts anything inside the perimeter.
The gap is not a lack of technology. It is a misunderstanding of what Zero Trust is. Zero Trust is not a product, and it is not a project with an end date. It is an architectural approach and an operating model, one that changes how access decisions are made across identity, devices, networks, applications and data.
This article sets out what Zero Trust means in practice, the framework we use to plan enterprise implementations, and the pitfalls that cause programmes to stall.
What Zero Trust actually means
The traditional enterprise security model was built on a perimeter. Users and devices inside the corporate network were trusted; those outside were not. Firewalls, VPNs and network segmentation enforced the boundary.
That model has been eroded by almost every major technology trend of the last fifteen years: cloud services, remote working, mobile devices, software-as-a-service, third-party integrations. Today, much of an organisation's data and many of its users sit outside any meaningful perimeter. And when an attacker compromises a single device or credential inside the perimeter, the implicit trust it grants allows them to move laterally with little resistance.
Zero Trust replaces implicit trust with explicit, continuous verification. NIST Special Publication 800-207, the most widely referenced definition, describes a set of core tenets. In plain terms:
- No implicit trust based on network location. Being on the corporate network does not grant access to anything.
- Every access request is authenticated and authorised based on the identity of the user, the health of the device and the context of the request.
- Access is granted per session, with least privilege. Users receive access to the specific resource they need, for the time they need it.
- Policy is dynamic. Decisions consider signals such as device posture, location, behaviour and risk, and can change as those signals change.
- The organisation continuously monitors the security posture of its assets and uses that information to improve access decisions.
A five-pillar framework
We structure Zero Trust programmes around the five pillars defined in CISA's Zero Trust Maturity Model: identity, devices, networks, applications and workloads, and data. Each pillar has its own maturity journey, and progress in one depends on progress in others. Visibility and analytics, automation and orchestration, and governance run across all five.
Identity
Identity is the foundation of Zero Trust, because every access decision starts with the question of who is asking. Mature identity capabilities include:
- A single, authoritative identity source for employees, contractors and, where appropriate, partners.
- Phishing-resistant multi-factor authentication, such as FIDO2 security keys or platform authenticators, rather than SMS codes or push approvals that can be socially engineered.
- Lifecycle management that grants access on joining, adjusts it on role change and removes it promptly on leaving.
- Privileged access management with just-in-time elevation, so administrative rights exist only when needed.
- Risk-based conditional access that considers the context of each sign-in.
In our assessments, identity is where the largest gains are usually available. Orphaned accounts, excessive standing privileges and weak authentication for administrators remain common, even in organisations with mature security functions.
Devices
Access decisions must consider the health of the device making the request. This requires an accurate inventory of devices, visibility of their security posture (patch level, encryption, endpoint protection status) and the ability to feed that posture into access policy. An unmanaged or non-compliant device should receive restricted access, or none at all.
Networks
In a Zero Trust architecture, the network is no longer the primary control, but it still matters. The key shift is from large flat networks to microsegmentation: dividing the environment into small zones so that a compromise in one cannot spread freely. Encrypting internal traffic and replacing broad VPN access with application-level access are other common steps.
Applications and workloads
Applications should authenticate and authorise every request, rather than relying on the network to have done so. For internal applications, this often means placing them behind an identity-aware access proxy. For workloads communicating with each other, it means strong service identity and explicit policy about which services may talk to which.
Data
Ultimately, Zero Trust exists to protect data. That requires knowing what sensitive data the organisation holds, where it lives and who should access it, then enforcing that access consistently through classification, encryption, and data loss prevention controls.
Sequencing an enterprise programme
Zero Trust cannot be delivered in a single phase. A realistic enterprise programme unfolds over several years, and sequencing matters. The approach we recommend follows four stages.
Stage 1: Establish visibility
It is impossible to apply least-privilege access to resources you cannot see. The first stage builds inventories of identities, devices, applications and sensitive data, and establishes the logging needed to understand how access actually happens today.
Stage 2: Strengthen identity
Identity improvements typically deliver the greatest risk reduction for the least disruption. Consolidating identity providers, enforcing phishing-resistant MFA (starting with administrators and high-risk users) and removing standing privileges should come early.
Stage 3: Protect the crown jewels
Rather than attempting to segment the entire environment at once, identify the most critical applications and data (the systems whose compromise would cause the greatest harm) and apply Zero Trust controls to them first. This demonstrates value quickly and builds the patterns that will be reused elsewhere.
Stage 4: Expand and automate
With foundations and patterns in place, controls are extended across the wider estate, and access decisions are progressively automated based on real-time risk signals.
The organisations that succeed with Zero Trust are those that pick one critical system, protect it properly, and then repeat the pattern, not those that attempt to transform everything at once.
Common pitfalls
In the programmes we have assessed or recovered, the same mistakes recur.
Buying before designing. Purchasing a Zero Trust network access product without a target architecture typically results in a modern VPN replacement that still grants broad access. The architecture and policies must come first.
Neglecting legacy systems. Many enterprises depend on legacy applications that cannot support modern authentication. These need a deliberate strategy (isolation, access proxies, or replacement) rather than being quietly excluded from scope.
Underestimating operational change. Zero Trust changes how people request and receive access. Without clear processes and responsive support, users will find workarounds, and the programme will lose credibility.
Measuring deployment rather than risk reduction. Counting licences deployed or applications onboarded says little about whether the organisation is safer. Better measures include the reduction in standing privileged accounts, the proportion of access protected by phishing-resistant MFA, and the reduction in lateral movement paths identified during testing.
Treating it as a security-team project. Zero Trust touches infrastructure, applications, identity, end-user computing and the business. Programmes owned solely by the security team struggle to get the cross-functional commitment they need.
Measuring maturity
A maturity model gives leadership a way to understand progress and prioritise investment. For each of the five pillars, we assess current capability against defined levels, from traditional through to optimal, and agree a realistic target for the next twelve to twenty-four months.
The value of the exercise is not the score. It is the shared understanding it creates between security, technology and business leadership about where the organisation is exposed and what it will take to close the gap.
Where to begin
For organisations starting or restarting a Zero Trust programme, we recommend four immediate actions:
- Enforce phishing-resistant MFA for all administrative and privileged accounts.
- Build a reliable inventory of identities, devices and critical applications.
- Identify the five to ten systems whose compromise would cause the greatest harm.
- Design and implement a Zero Trust access pattern for one of those systems, and use it as the template for the rest.
Zero Trust is a long journey, but it is not an abstract one. Each step (stronger identity, better device visibility, narrower access to critical systems) measurably reduces the likelihood and impact of a breach. Our cybersecurity practice helps organisations design architectures that fit their environment, sequence the work sensibly and measure progress in terms of risk reduced rather than products deployed.