"Trust no one" sounds paranoid – and is still right
I'll admit it: "Zero Trust" is one of those IT terms that sound as if a marketing team made them up. No trust? For anyone? That sounds like an exhausting place to work.
But once you look at how most company networks operate today, it quickly becomes clear why the approach makes sense. The classic security model works like a castle: a thick wall around everything, and whoever gets inside can move around freely. The problem? When someone gets over the wall – and that happens regularly – they have access to everything.
80% of all data breaches involve compromised credentials. And once an attacker is inside the network, they move around undetected for an average of 277 days. Almost ten months. During that time they can reach everything the compromised person can reach – and often more.
What Zero Trust really means
Set the buzzword aside for a moment and focus on the core idea: every access is verified. Every time. Regardless of whether the user is sitting in the office or at home, whether they were verified yesterday or not.
That doesn't mean your staff have to log in constantly. Modern Zero Trust systems work in the background: they check not only who someone is, but also which device they're using, at what time, from which location, and whether their behaviour matches the usual pattern. If everything looks normal, the user notices nothing. If something stands out – say, a login at 3 a.m. from another country – additional verification is requested automatically.
Add to that the principle of least privilege: everyone gets access only to what they need for their current task. Accounting doesn't need to reach the development servers. The marketing intern doesn't need admin rights. Sounds obvious? You'd be surprised how many companies handle it differently.
Why this works for mid-sized businesses
When I say "Zero Trust", I often get a knowing nod, followed by: "Sure, but that's only for large corporations." Not true. Zero Trust can be implemented step by step, and the first steps cost almost nothing.
Take MFA. Conditional Access is already included in Microsoft 365 Business Premium. You can use it to specify that employees may only sign in from trusted devices, that logins from certain countries are blocked, and that unusual behaviour automatically triggers additional authentication. Setting it up takes an afternoon. The effect is enormous.
Then separate your admin accounts from regular user accounts. Many IT managers use the same account for their daily work and for server administration. That's like a bank director carrying the vault key on the same keyring as the front-door key. Creating two separate accounts takes five minutes and eliminates a significant risk.
The next step is network segmentation. It sounds like a major project but starts very simply: separate the guest Wi-Fi completely from the company network. Put IoT devices such as printers and cameras in their own VLAN. Servers in a separate segment. Most modern switches and firewalls can already do this – it's a matter of configuration, not budget.
The pragmatic path: phase by phase
In the first three months, focus on the quick wins: enable MFA everywhere, separate admin accounts, introduce a password manager, set up Conditional Access. Cost: minimal. Impact: massive.
In months four to nine, lay the foundation: roll out EDR on all devices, segment the network, introduce regular access reviews. Moderate costs arise here – roughly 5-15 euros per device per month for EDR – but the investment pays off.
From month ten onwards, tackle the advanced topics: replace VPN with Zero Trust Network Access, introduce Data Loss Prevention, build central security monitoring. These are the measures that take you from "well protected" to "professionally protected".
For a company with 100 employees we estimate running costs of around 2,500-3,000 euros per month once everything is rolled out. That sounds like a lot until you consider that a single security incident costs an average of 150,000 euros.
The most common objections – and why they don't hold up
"Our employees won't accept this." The opposite is true. Modern Zero Trust solutions are often more user-friendly than old VPN clients. And everyone knows MFA from online banking by now.
"We're too small to be a target." SMEs in particular are preferred targets because attackers expect less resistance. Ransomware groups scan automatically – they don't care how big your company is.
"Our IT doesn't have the capacity." Then managed security is an option. Many Zero Trust components are available as a managed service, where an external partner handles implementation and operation.
The world has changed. Your security should too.
Employees work from anywhere. Data lives in the cloud. The boundaries of your network have blurred. The old model – put everything behind a firewall and hope – no longer works.
Zero Trust is not a fad. It's the logical response to the reality of 2026. And it starts with one simple step: enable MFA. Today.
*Where does your company stand on Zero Trust? Let's take a look together in a free initial consultation. Book an appointment*
