The Problem
“Zero-trust” has been thoroughly captured by enterprise sales. Say the phrase and a vendor appears to sell you a six-figure platform: a full ZTNA suite, an identity-governance product, a microsegmentation fabric, a year of professional services. For a Fortune 500 that’s the right conversation. For a 30-person regulated SMB it’s a reason to conclude zero-trust is out of reach and keep running the flat network behind a VPN.
That conclusion is wrong, and the flat-network-behind-a-VPN posture it justifies is the exact thing that gets SMBs breached. The VPN is a moat. The moat model assumes the attacker is outside. But the attacker’s most reliable path in is a phished employee credential, and once that credential is inside the moat, a flat network hands them everything.
Zero-trust is a principle, not a product: never trust, always verify — verify every request as though the network is already compromised, because it is. The principle is achievable for an SMB with tools you likely already pay for. The trick is sequencing, not spending.
The Approach
Four phases, in order. The order matters more than the tooling — each phase makes the next one meaningful. Buying the microsegmentation product before you’ve consolidated identity is spending money on phase three while phase one is still open.
Phase 1: Consolidate identity
This is the whole game, and most of the value. Zero-trust verifies identity on every request, so you need one authoritative identity per person and one place to revoke it.
- SSO across every SaaS tool that supports it. One identity provider — you likely already have Google Workspace or Microsoft Entra — fronting every app. The goal: offboarding a person is one action, not forty.
- MFA universal, no exceptions. Every account, every human. Phishing-resistant MFA (passkeys, FIDO2 hardware keys) for anyone with administrative access, because that’s the credential worth stealing.
- Kill the shared logins. The
admin@account that four people know the password to is the opposite of verifiable identity. Named accounts only.
Good-enough bar for an SMB: SSO fronting 90% of your SaaS, MFA on 100% of accounts, FIDO2 on every admin. You can reach this with tools you already own. No new platform required.
Phase 2: Establish device trust
Verifying the person isn’t enough if they’re on a compromised machine. Phase two is knowing the device is one you manage.
- Managed, encrypted devices for anyone touching regulated data. Full-disk encryption enforced, OS current. A lightweight MDM (there are SMB-priced options, and Apple Business Manager plus a basic MDM covers a Mac fleet cheaply) gives you enforcement without an enterprise endpoint suite.
- Known devices only for sensitive systems. Access to the production console or the PHI store comes from a managed device, not from someone’s personal laptop at a coffee shop.
Good-enough bar: every device that touches regulated data is encrypted, updated, and enrolled. You don’t need a $50/seat EDR platform to clear this bar; you need enforcement of the basics.
Phase 3: Segment the network
Now retire the moat. A flat network where a single compromised device can reach everything is the failure mode zero-trust exists to prevent.
- Segment by sensitivity. The production PHI environment is not on the same flat network as the office printer and the marketing laptops. Cloud-native segmentation (VPC boundaries, security groups) does most of this for free if you’re already in AWS or GCP.
- Retire the VPN-as-moat. Replace “connect to the VPN and you’re trusted” with per-application access that checks identity and device every time. Cloudflare Access, Tailscale, and Google’s BeyondCorp-style access are SMB-affordable and often cheaper than the VPN concentrator they replace.
Good-enough bar: the regulated environment is isolated from the general network, and reaching it verifies identity and device per session rather than per VPN connection.
Phase 4: Verify continuously
The first three phases are structural. Phase four keeps them honest over time.
- Conditional access. Access decisions consider identity, device posture, and context — a login from a new country on an unmanaged device gets challenged or blocked, not waved through.
- Log and review. Access events flow to the same centralized logging you built for compliance. The point of “always verify” is lost if nobody ever looks at what was verified.
Good-enough bar: anomalous access gets challenged automatically, and access logs are reviewed on the same cadence as your other security controls.
The Template
The maturity model. Score each phase honestly — Not started / Partial / Done. Work top to bottom; a later phase built on an incomplete earlier one is wasted money.
Phase 1 — Identity
- SSO fronts every SaaS tool that supports it
- MFA enforced on 100% of human accounts, no exceptions
- Phishing-resistant MFA (FIDO2 / passkeys) on every admin account
- Shared / role logins eliminated; named accounts only
- Offboarding a person is a single revocation action
Phase 2 — Device
- Full-disk encryption enforced on every work device
- OS + critical updates enforced (not left to the user)
- Devices touching regulated data are enrolled in MDM
- Sensitive systems reachable only from managed devices
Phase 3 — Network
- Regulated environment segmented off the general/office network
- Cloud segmentation (VPC / security groups) enforces the boundary
- VPN-as-moat replaced with per-application access checks
- No single device can reach everything on a flat network
Phase 4 — Continuous verification
- Conditional access considers device posture + context, not just password
- Anomalous access (new device, new geo) is challenged or blocked
- Access events flow to centralized logging
- Access logs reviewed on a defined cadence
Most SMBs score Phase 1 at Partial and everything below at Not Started. That’s a normal starting point. The path from there is one phase at a time, in order, using tools you mostly already own.
Operating Notes
Sequence is the whole discipline. The reason zero-trust projects fail isn’t the tooling — it’s buying phase three before finishing phase one, then wondering why the expensive segmentation product didn’t stop the phished credential that still had flat access to everything. Identity first, always.
Resist the platform pitch until you’ve earned it. The four phases above get an SMB to a genuine zero-trust posture using an identity provider you already have, a modest MDM, cloud-native segmentation, and an access proxy that’s often cheaper than the VPN it replaces. There’s a point of scale where a dedicated ZTNA platform earns its cost. Most regulated SMBs are years away from that point and would get more security per dollar finishing phases one and two.
The bar isn’t “enterprise zero-trust.” The bar is “a phished credential on an unmanaged device can’t reach the PHI store.” That bar is reachable this quarter, and it’s the one that actually keeps you out of a breach notification.