The problem with the flat network
Traditional VPNs place a user on the network and trust them broadly once connected. If those credentials are stolen, the attacker inherits the same reach. Zero trust replaces implicit network trust with explicit, per-request decisions based on identity, device health and context.
Principles to design around
- Verify explicitly — authenticate and authorise every request using identity, device and context
- Least privilege — give access to specific applications, not network segments
- Assume breach — segment, monitor and limit blast radius
The 12-week roadmap
Weeks 1–3: Identity foundations
- Consolidate on a single identity provider for workforce access
- Enforce phishing-resistant MFA for administrators and remote users
- Clean up stale accounts and shared credentials
Weeks 4–6: Device trust
- Require managed, compliant devices for sensitive applications
- Feed endpoint health signals into access decisions
- Define a limited path for contractors and unmanaged devices
Weeks 7–9: Application access
- Inventory applications reached through the VPN
- Publish the first group through a zero trust network access (ZTNA) gateway or identity-aware proxy
- Write access policies per application and per user group
Weeks 10–12: Migrate and retire
- Move remaining user groups in waves, starting with low-risk teams
- Keep the VPN for a short fallback window, then restrict it to break-glass use
- Monitor access logs for anomalies and policy gaps
Measuring success
- Percentage of applications accessed through policy-based access
- Percentage of privileged users on phishing-resistant MFA
- Reduction in standing network-level access
- Mean time to revoke access for leavers
Mistakes to avoid
- Buying a product before defining policies
- Leaving service accounts and APIs out of scope
- Forgetting the user experience — friction drives workarounds
Key takeaways
- Zero trust replaces network location with per-request checks on identity, device and context.
- Start with phishing-resistant MFA and a single identity provider.
- Migrate applications in waves and keep the VPN only for break-glass access.
Frequently asked questions
Is zero trust a product?
No. It is an architecture approach. Products such as ZTNA gateways and identity providers help implement it, but policies and identity hygiene come first.
What is phishing-resistant MFA?
Authentication that cannot be relayed by a fake login page — for example FIDO2 security keys or platform passkeys — unlike SMS codes or simple push approvals.
Can legacy applications be included?
Often yes, by publishing them through an identity-aware proxy, though some may need modernisation or network-level controls as an interim step.
Zero trust is a direction of travel, not a product you install.
Our cyber security architecture team designs and delivers zero trust programmes for regulated enterprises.
