The Problem with "Never Trust, Always Verify"
Zero Trust has become the most overused phrase in cybersecurity marketing. Vendors apply the label to firewalls, VPNs, and identity products with equal enthusiasm. The result: organisations believe they have "achieved Zero Trust" by purchasing a product, when in reality they have barely begun the journey.
Zero Trust is an architectural philosophy, not a product category. It requires coordinated changes across identity, device, network, and application layers — and it is never truly "complete."
The Three Core Principles
1. Verify Explicitly Every access request must be authenticated and authorised based on all available data points: identity, device health, location, service, and data classification. This means moving beyond username and password to continuous evaluation.
2. Use Least Privilege Access Limit user access with just-in-time (JIT) and just-enough-access (JEA) policies. Eliminate standing privileged access. Every account should have only the permissions required for the immediate task.
3. Assume Breach Design as if attackers are already inside the network. Segment everything. Encrypt all traffic — including east-west. Deploy end-to-end telemetry so breaches are detected quickly and blast radius is minimised.
Where to Start: The Five Pillars
Pillar 1: Identity (Start Here)
Identity is the new perimeter. Begin with:
- Enable Multi-Factor Authentication (MFA) for all users — no exceptions
- Implement Conditional Access policies that evaluate risk signals before granting access
- Deploy Azure AD Identity Protection to score sign-in risk
- Eliminate shared accounts and service accounts with excessive permissions
- Implement Privileged Identity Management (PIM) for all admin roles
Pillar 2: Devices
Devices without verified health should not access corporate resources:
- Enrol all devices in Microsoft Intune or equivalent MDM
- Require device compliance as a condition for Conditional Access policies
- Deploy Microsoft Defender for Endpoint for continuous device health assessment
- Implement application control to prevent unauthorised software execution
Pillar 3: Network
Segment your network to limit lateral movement:
- Replace flat network architecture with micro-segmented zones
- Implement Azure Firewall or Palo Alto NGFW between segments
- Move towards software-defined perimeter (SDP) to replace VPN
- Enable DNS security filtering to block malicious domains
Pillar 4: Applications
Treat every application as internet-facing, regardless of whether it is:
- Implement application proxy for on-premises apps (Azure AD App Proxy)
- Enforce MFA at the application layer, not just the perimeter
- Scan all application traffic for threats — including HTTPS
- Implement CASB (Cloud Access Security Broker) for SaaS visibility
Pillar 5: Data
Classify and protect data wherever it lives:
- Implement Microsoft Purview Information Protection for data classification
- Apply labels automatically based on content and context
- Enforce data loss prevention (DLP) policies across Microsoft 365 and endpoints
- Encrypt sensitive data at rest and in transit
A Realistic Implementation Timeline
Months 1-3 (Foundation)
- MFA everywhere
- Conditional Access baselines
- Device enrolment
- Privileged Identity Management
Months 4-6 (Segmentation)
- Network microsegmentation
- Application proxy deployment
- Data classification baseline
- Endpoint protection hardening
Months 7-12 (Optimisation)
- Identity governance automation
- Continuous access evaluation
- CASB deployment
- Threat hunting programme
Measuring Success
Zero Trust maturity is measured on a spectrum, not as a binary state. Microsoft's Zero Trust Rapid Modernisation Plan (RaMP) provides a useful framework for tracking progress. Key metrics to track:
- Percentage of users with MFA enabled
- Percentage of devices enrolled and compliant
- Number of lateral movement incidents detected
- Mean time to detect (MTTD) and respond (MTTR) to incidents
The Bottom Line
Zero Trust is a multi-year journey, not a project you complete. Organisations that approach it as a continuous improvement programme — rather than a product purchase — are the ones that achieve meaningful security improvements. Start with identity, demonstrate quick wins, and build momentum.