Zero trust without the vendor bingo

Say “zero trust” in a meeting and two things happen: everyone nods, and nobody can state what work it implies. The term has been so thoroughly marketed that it now functions as a budget line rather than an architecture. That is a shame, because underneath the vendor bingo there are four genuinely good decisions, and most cloud-based companies can implement all four with tools they already pay for.

Decision one: identity is the perimeter

Every request to every internal system authenticates against your identity provider, with MFA, no exceptions for being “inside” anything. In practice this means putting every internal app behind SSO, killing shared accounts, and treating VPN membership as a convenience rather than an authorization.

You likely own everything this requires today: an identity provider, SSO support in most of your SaaS, and an identity-aware proxy from your cloud vendor for the internal apps that never learned SAML or OIDC.

Decision two: the network stops implying permission

Being on the corporate network, or inside the VPC, grants nothing by itself. Flat networks are how one phished laptop becomes a company-wide incident, and how one compromised microservice reads every database.

The work here is segmentation with intent: security groups that name specific sources instead of whole CIDR ranges, separate accounts or projects per environment, and deny-by-default between services. Tedious, unglamorous, extremely effective. No purchase required.

Decision three: devices earn access

If a laptop has no disk encryption, no screen lock, and an OS from 2022, it should not open your production console, no matter whose it is. Device posture checks at login enforce that.

Most identity providers can do a workable version of this using signals from the MDM you probably already run. Start with two rules: encrypted disk and current OS. You can grow conditions later. The first two catch the cases that actually show up in incident timelines.

Decision four: access expires

Standing permissions are where least privilege goes to die. People change teams, projects end, vendors rotate, and the grants remain. The zero trust answer is time-boxed access: production roles that are assumed for hours, not held for years, and quarterly reviews for whatever cannot expire automatically.

Cloud IAM already supports this model with short-lived credentials and assumable roles. The change is habit, not tooling: nobody holds admin, everybody borrows it.

The order matters more than the tools

We sequence this work the same way at almost every client:

1. SSO plus MFA everywhere, because it multiplies the value of everything after it.
2. Environment and service segmentation, because it caps the cost of any single compromise.
3. Device posture at login, because it closes the phished-laptop path.
4. Time-boxed privileged access, because it shrinks the standing attack surface month after month.

A team that finishes step two has eliminated more real risk than most “zero trust platform” deployments we have assessed. When a vendor tool genuinely fills a gap in this sequence, use it. But buy the gap, not the slogan.

If you want a second opinion on where your environment sits against these four decisions, that review takes us about two weeks, and it produces a roadmap instead of a shopping list.