Zero Trust for a small company starts with an “identity-first” approach: phishing-resistant MFA, clean accounts and permissions, device control, and data access segmentation. It’s the fastest way to limit the damage from phishing and account takeovers.
What is Zero Trust in practice, and why doesn’t “VPN = security” work anymore?
Zero Trust is an approach where you don’t trust by default — not the user, not the device, not the network, even if it’s “inside the company.” Every access request is treated as potentially risky and should be:
- verified (identity, device, context),
- limited (least privilege),
- monitored (logs, anomaly detection),
- enforced by policy (not case by case).
In practice, a VPN only gives you “a tunnel to the inside.” If an account is compromised, the attacker often gets exactly what the user has. That’s the core of the problem, because a large share of breaches start with a person and their account. In the 2024 DBIR, the “human element” appears in 68% of breaches.
Where should a 10–200 person company start with Zero Trust so it makes sense and doesn’t kill productivity?
First, a principle I repeat to students and clients alike: Zero Trust is a sequence of actions, not the purchase of a single product.
For a small company, the best order looks like this:
- Identity and login
- Devices and their state
- Permissions and application access
- Data and backups
- Monitoring and response
This is also consistent with the “pillars” approach used in Zero Trust maturity models.
How do you build a “minimum viable Zero Trust” in 30 days?
Below is a version you can realistically roll out in a small company without a huge budget, as long as you have reasonable control over IT.
1) How do you get identities and accounts in order as the foundation of Zero Trust?
- Make a list: employee accounts, contractor accounts, service accounts, admin accounts.
- Disable or restrict unused accounts.
- Introduce a rule: a separate admin account (even in a small company).
- Enforce strong passwords only as a transitional step, since your real goal is phishing-resistant methods.
Result: fewer “silent” accounts, which are an ideal target after a password leak.
2) How do you roll out MFA so it actually blocks account takeovers?
For a small company, the best starting point is:
- mandatory MFA for email, VPN, admin panels, accounting, and CRM,
- prefer phishing-resistant methods (FIDO2/WebAuthn, passkeys) for admins and sensitive roles,
- limit SMS and email as a fallback method (a common bypass vector).
In a Zero Trust approach, MFA isn’t a “checkbox” — it’s an access condition tied to risk.
3) How do you handle devices so you’re not letting “unknown laptops” into company resources?
- Define which devices are company-managed.
- Enforce disk encryption, updates, and screen locking.
- Set a minimum standard: a supported, up-to-date OS, EDR/antivirus, no local admin rights “for everyday use.”
In practice, this is the difference between “account taken over” and “account taken over and the attacker immediately moves laterally across the network.”
4) How do you cut the biggest mistake: overly broad permissions?
- Do a quick review: who has access to what and why.
- Restrict access to shares, panels, and data to groups, not individuals.
- Introduce a rule: access is granted based on role and need, not because “someone asked.”
This is where Zero Trust delivers an immediate return, because it limits the scale of damage even if an attack succeeds.
5) How do you set up logging and monitoring without building a “mini-SOC”?
In a small company, you don’t start with a SIEM that costs a fortune. You start by simply having a trail:
- login logs for email and your IdP,
- administrative logs (permission changes, MFA resets),
- alerts for unusual logins and mass data downloads,
- simple retention and someone responsible for reviewing alerts.
Mandiant reports a median dwell time of 10 days in 2023. That means that without meaningful alerts, an attacker can stay inside “quietly” long enough to do real damage.
What does a practical 30–90 day plan look like once the basics are in place?
How do you implement conditional access and risk-based policies?
- Block logins from unusual locations, countries, or anonymizing networks.
- Require stronger authentication for sensitive actions (data changes, exports, financial operations).
- Restrict logins to admin panels to managed devices only.
This is a classic “Zero Trust policy engine” in practice, just implemented pragmatically.
How do you limit lateral movement on the network if you have an office and a few servers?
- Segment the network: guests, IoT, employee computers, servers.
- Restrict traffic: a “only the ports and directions you need” rule.
- Make sure a user’s device can’t see everything “laid out in front of it.”
In a small company, even simple segmentation often defuses the worst ransomware scenarios.
How do you organize data so Zero Trust covers “what matters most”?
- Classify: critical, sensitive, and ordinary data.
- Separate storage of critical data from everyday “shares.”
- Introduce control over sharing and links, especially in cloud tools.
How do you move to passwordless, and does it make sense for a small company?
It makes sense, provided you don’t break the account recovery process.
A good approach:
- passwordless first for sensitive roles (admin, finance),
- then for the rest of the organization,
- always with a fallback plan: what happens if someone loses their phone, changes devices, or loses access to their key.
Passwordless is part of a more mature IAM setup, but on its own it doesn’t “do Zero Trust” if you still have broad permissions and no segmentation.
What mistakes most often kill Zero Trust in a small company?
- MFA enabled but not enforced for all critical services.
- Recovery methods that are easier to bypass than MFA itself.
- Everyone has broad permissions “because it’s convenient.”
- No separation between admin and user accounts.
- No logs and no one responsible for reviewing alerts.
These are things I see regularly in small organizations after their first incident.
How do you check whether Zero Trust is actually working, not just “sounding good”?
Set 6 simple metrics:
- % of accounts with MFA and % with phishing-resistant MFA (for critical roles),
- number of admin accounts and how long admin privileges are used,
- number of policy exceptions (and who approves them),
- time to detect an unusual login and time to respond,
- number of “unmanaged” devices with access to company resources,
- number of resources with public or “everyone” access.
If these numbers move in the right direction, Zero Trust isn’t theory — it’s a real shift in risk.
Sources
- NIST SP 800-207: Zero Trust Architecture: (NIST Pubs)
- CISA: Zero Trust Maturity Model v2.0: (CISA)
- Verizon: 2024 Data Breach Investigations Report (including 68% “human element”): (Verizon)
- Google Cloud / Mandiant: M-Trends 2024 (median dwell time of 10 days in 2023): (services.google.com)