"Zero trust" sounds like a project for a bank with a security team of forty. The idea underneath the name is simpler than the jargon suggests: stop treating anything inside your office network as automatically safe, and start checking who is asking for what, every single time.
For a ten-person design studio or a thirty-person plumbing supplier, that is not a six-figure rebuild. It is a sequence of small, mostly boring changes you can spread across a year, and most of them use tools you already pay for.
What Zero Trust Actually Means
The old model worked like a castle. You built a wall (the firewall), dug a moat (the VPN), and once someone was inside, they could wander more or less freely. The file server, the accounting share, the customer database, the printer's web console: all reachable from any laptop on the office network. Being inside was the proof of trust.
Zero trust throws that assumption out. Location proves nothing. A request to open the invoicing app from a laptop in your own office gets evaluated on the same terms as a request from a hotel in another country. Who is the user? What device are they on? What exactly are they asking for? Does that make sense right now?
That is the whole philosophy. Zero trust is a direction you move in, not a box you buy. No vendor sells a device that makes a business "zero trust" on a Friday afternoon.
The questions behind every decision
- Who are you? A named person, signed in with multi-factor authentication, not a shared login passed around the office.
- What are you using? A managed, patched, encrypted device rather than an unknown laptop on a café network.
- Should you have this? Access to the one application you need, not the whole network it happens to sit on.
Why This Matters More to Small Businesses Than You Might Think
Small companies are attractive for two reasons. First, attackers assume defenses are thinner, and often they are right. Second, a small supplier is a doorway into a larger customer, which makes an unglamorous business a useful stepping stone.
There is also a structural problem. Most small businesses run flat networks: one subnet, everything visible to everything else, and a couple of admin passwords that half the team knows. One phished password then becomes access to everything, because nothing stands between the email account and the finance system. Zero trust is essentially the work of putting doors back in the corridor.
You Do Not Have to Replace Your Infrastructure
This is where people get scared off. Nobody is asking you to rip out your firewall or abandon Microsoft 365 or Google Workspace. The realistic version of zero trust for a small business is three things: configure what you already own more strictly, close the gaps that keep showing up in breaches, and add a thin layer of identity and device checks where money or customer data is involved.
If anything, cloud tools have made this easier. A per-application sign-in is much simpler to control than a per-network share ever was.
A Gradual Rollout You Can Actually Finish
Phase 1: Identity, months one and two
- Turn on multi-factor authentication for email, the VPN, banking, accounting software and every admin console. Start there, not everywhere.
- Retire shared accounts. Give each person their own login. A shared "info@" mailbox is fine; a shared administrator account is not.
- Separate admin rights from everyday use. If someone needs admin access, they should have a second account for it and use it only when required.
- Deploy a password manager. It ends password reuse faster than any policy document.
Phase 2: Devices, months three to five
- Write down every device that touches company data, including phones.
- Turn on full-disk encryption and automatic patching. Do not leave updates to people's memory.
- Decide what happens with personal devices. Either they are enrolled and managed, or they get webmail and nothing else. Both answers are acceptable; a vague middle ground is not.
Phase 3: Access, months four to eight
- Review who can reach what. Remove accounts for former staff and old contractors in the same week they leave, not eventually.
- Apply least privilege in ordinary language: the design team does not need the payroll folder.
- Grant access per application instead of per network wherever possible.
- If your plan supports conditional access rules, use them. Blocking sign-ins from countries you never work in, or requiring a managed device for finance apps, stops a lot of trouble cheaply.
Phase 4: Assume something will slip through
Turn on audit logging and actually look at it. Sign-in alerts are the useful starting point: logins from unusual places, repeated failed attempts, a stream of MFA prompts someone keeps approving. Keep backups in the 3-2-1 pattern, with one copy offline or immutable, and restore a file by hand once or twice a year so you know the backup works.
Mistakes That Waste Time and Money
- Buying a product and calling it a strategy. Most of this work is configuration and habit, not licensing.
- Rolling everything out at once and breaking how people work. Move in waves, starting with whoever handles money.
- Forgetting contractors, freelancers and the bookkeeper who logs in twice a month.
- Keeping the setup in one person's head. If only one employee understands it, that is a single point of failure.
- Skipping the basics. Patching, backups and MFA come first. Zero trust layered on top of an unpatched laptop is decoration.
What to Do in the Next Two Weeks
Pick one item from each line and put a date next to it.
- List every account with administrator rights. If the list is longer than the number of people who genuinely need it, trim it.
- Confirm MFA is switched on for email and remote access. This is the single highest-value hour you will spend this quarter.
- Inventory devices and check that laptops and phones are encrypted and updating automatically.
- Write one page describing who can access which systems. Share it with your team.
- Schedule one improvement per month for the rest of the year.
If you handle regulated data, such as health records or financial information, bring in someone who knows the specific obligations that apply to you and get their advice in writing. A managed IT provider can also run the technical phases for you, though you should still understand what they changed and why.
The goal is not a perfect security posture. It is that a stolen laptop, a phished password or a departed employee with old credentials stops being a company-wide event. Get that far, and you have done real zero trust work.
Photo: cottonbro studio / Pexels