What this protects
The account that is now your front door
Cyber insurance and client questionnaires increasingly ask about identity controls. Zero trust is how a small business answers without buying a platform.
Your licence to operate
Insurers and larger clients now ask whether multi-factor authentication is on. A vague answer can lose you the work.
Client trust
Most breaches start with a stolen password rather than a clever attack. Protecting the sign-in is protecting the relationship.
Staff productivity
Good controls are barely noticeable on a normal day. Bad ones get worked around, which is worse than having none at all.
What zero trust actually means, in plain English
For thirty years the office network was a castle. You built a wall, checked who came through the gate, and once they were inside they could wander more or less anywhere. The model assumed that anything already within the walls could be trusted, which held up only as long as the walls did.
Zero trust removes that assumption. It says the network is not a place where trust is granted; it is a location, and locations prove nothing. Every device and every person is checked every time they reach for something, whether they are at a desk in County Durham or on a train.
That sounds heavy. In practice, at the size of business we look after, it usually comes down to four ordinary things rather than a product you buy.
Why the cloud quietly changed the maths
Zero trust was impractical for a small business when everything lived in a server cupboard. You needed expensive identity tooling to approve every request, and the effort outweighed the risk.
Then email, files and applications moved to Microsoft 365 and similar services, and identity moved with them. Your sign-in is now the front door. Suddenly the controls enterprise security teams built by hand are settings in the tools you already pay for: multi-factor authentication, conditional access, device compliance.
What it usually comes down to
Prove who you are
Multi-factor authentication on every account that offers it, with the awkward exceptions closed rather than tolerated.
Give only what is needed
Access to the folders and systems each job requires, reviewed when people change role rather than when something goes wrong.
Check the device
Only managed, patched, protected devices get in. An unmanaged laptop is treated as unknown, whoever is holding it.
Assume the network is hostile
The office Wi-Fi is treated like a hotel lobby. Being on it earns you nothing.
Watch for the odd
Sign-ins from unusual places, impossible travel, sudden privilege changes, all flagged with someone accountable for looking.
Make it frictionless or it fails
Controls that slow people down get worked around. The good version is barely noticeable on a normal day.
What a sensible rollout looks like at twenty staff
- Turn on multi-factor authentication for every account, then audit for the service someone excluded \"temporarily\" in 2021
- Clean up who can access what, starting with the accounts that belong to people who have left
- Require managed devices for email and file access, and decide what to do about personal phones
- Remove standing administrator rights, so everyday work is done as a normal user
- Add conditional access rules that block sign-ins from countries you do not operate in
- Write it down, so the next person understands why the rules exist
What it costs, honestly
Most of this is configuration rather than purchase, which means the cost is time, ours and your team's, rather than a licence you did not have before.
The friction is real but small. People will occasionally have to approve a sign-in on their phone. The ones who complain loudest are usually the ones the controls exist to protect.
Where a full programme is overkill
- Businesses with no remote access, no cloud services and no contractors
- A single-site firm where every user has identical, non-sensitive access anyway
- Anyone considering a \"zero trust platform\" before their passwords are unique
What to do about it
- Turn on multi-factor authentication everywhere, then go looking for the exceptions.
- Give people the access the job needs, not everything the last person had.
- Treat the office network as one location among many, not as a place of trust.
- Fix passwords and leavers first; the platform can wait.
Questions we get asked about this
Is zero trust a product we can buy?
No. It is a way of configuring what you already own. Several vendors will sell you a platform with the name on it, but the underlying controls are the same settings you could switch on this month.
Will it slow my team down?
Slightly, at first, and mostly in the sensible direction. A second to approve a sign-in beats a week recovering from an account that was never protected.
Do we need this if we already have antivirus?
Antivirus guards the device. Zero trust guards the account and the access. Most incidents start with a stolen password rather than a virus, so you need both.