Zero trust has been sold hard enough that the phrase now gets in the way of the idea. It is not a product. There is nothing to install called zero trust, and any vendor offering to sell you one is selling you a component of it at best.
What it actually means
The old model treated the network as a boundary. Get past the firewall and you were inside, and inside was trusted. That worked when everyone sat in one building on one network and the only way in was through the front door.
It stopped working when people started connecting from home, from client sites and from phones, and when the systems they connect to moved to platforms you do not own. There is no longer an inside.
Zero trust replaces the boundary with a question, asked every time: is this person who they claim to be, on a device we recognise, doing something they are permitted to do? Verify rather than assume, every request, regardless of where it comes from.
You are probably further along than you think
Most organisations we work with already have several pieces in place without calling them anything. Multi-factor authentication on email. Role-based permissions on the finance system. A guest wireless network kept separate from the corporate one. Each of those is a zero trust control.
What is usually missing is not tooling. It is that the pieces were added one at a time, in response to different incidents, and nobody has looked at them together.
The four moves that matter most
- Multi-factor authentication on everything, not just email. A stolen password should not be enough to get anywhere.
- Segment the network. Separate servers from user devices, and both from guest access, so a compromised laptop cannot reach the finance system.
- Know what is connected. You cannot control access from devices you do not know exist. Asset visibility comes before access control.
- Watch the alerts. Detection with nobody reading the output is not detection. This is the step organisations skip, and it is the one that decides whether an incident is contained or discovered later.
What it does not require
It does not require replacing your infrastructure. Most of the work is configuration, policy and sequencing rather than procurement. Where new tooling is needed it is usually identity management and monitoring, not a new firewall.
It also does not happen in one project. Organisations that try to do it all at once tend to break something visible early and lose support for the rest.
Where to start
With an audit of who currently has access to what, and how that access is verified. It is unglamorous, it usually finds accounts belonging to people who left, and it tells you which of the four moves above will make the most difference in your environment.
Let’s Find Out Who Has Access to What
Unison designs and manages security across endpoints, networks and identity, with continuous monitoring behind it. If you want to know where your gaps are, an access audit is the place to begin.