Zero Trust Is Not Optional Anymore Here’s How to Start

Why the Perimeter-Based Model Failed

The traditional security model was built on a simple premise: everything inside the network is trusted, everything outside is not. This model was never perfect insider threats existed long before remote work but it was at least coherent when the majority of users, devices and data lived inside a defined physical perimeter.

That world no longer exists. Today, users work from home, hotels, branches and third-party offices. Applications run in AWS, Azure, SaaS platforms and legacy on-premises systems simultaneously. Partners and contractors access internal systems through connections that are technically “outside” the network but operationally inside the trust boundary. The firewall is still there. What it protects is no longer meaningful.

The majority of successful cyberattacks across the GCC in recent years have involved compromised internal credentials not attacks that broke through the perimeter, but attacks that walked through it with stolen keys. The attacker is already “inside.” A model that extends trust to everything inside the network does not protect against the threat that actually materialises. Zero Trust does because it assumes the attacker is already present and verifies every access request regardless of where it originates.

The Three Principles

Zero Trust is built on three foundational principles that apply to every access decision across every system:

• Verify explicitly. Every user, every device, every access request is authenticated and authorised every time not once at login, but continuously. Context matters: who is requesting access, from which device, from which location, to which application, at what risk level?
• Least privilege. Every user and system receives only the minimum access required to perform their specific function. Nothing more. Lateral movement the attacker’s ability to move from one compromised account to other systems is constrained by the narrowness of each permission set.
• Assume breach. Design every part of the architecture as if a breach has already occurred. Segment environments, monitor continuously, detect anomalies, and maintain the ability to respond and isolate. When the breach comes and in a modern threat environment, it will the blast radius is contained.

Where to Start Identity First

Zero Trust is not a single product. It is a framework deployed across identity, devices, applications, network and data. For most organisations, the highest-impact and lowest-complexity starting point is identity specifically, Microsoft Entra ID as the cloud-native identity foundation.

The identity layer of a Zero Trust deployment typically includes four components. Microsoft Entra ID provides cloud-native identity management, replacing or federating with on-premises Active Directory. Multi-Factor Authentication is the single highest-ROI security investment an organisation can make MFA blocks the overwhelming majority of credential-based attacks and can be deployed across a 500-seat environment in two to four weeks. Conditional Access policies evaluate the context of every access request user risk, device compliance state, location, application sensitivity and apply appropriate controls dynamically. Privileged Identity Management eliminates standing administrator access, replacing it with just-in-time elevation for specific tasks with full audit logging.

A full identity Zero Trust deployment for a mid-market organisation typically completes in four to eight weeks. It immediately eliminates the majority of credential-based attack surface the attack vector responsible for most GCC breaches and provides the identity foundation on which every subsequent Zero Trust pillar is built.

Your 90-Day Roadmap

ACME’s Zero Trust implementation follows a structured 90-day programme that builds the architecture layer by layer:

• Days 1–30: Identity. Microsoft Entra ID deployment or federation, MFA rollout across all users, Conditional Access policies, Privileged Identity Management. Outcome: identity layer secured, standing privilege eliminated.
• Days 31–60: Devices. Microsoft Intune device management, endpoint detection and response (EDR) deployment, device compliance policies integrated with Conditional Access. Outcome: only compliant, managed devices can access sensitive applications.
• Days 61–90: Applications. Microsoft Defender for Cloud Apps (CASB) for SaaS visibility and control, Azure AD Application Proxy for secure remote access to on-premises applications, Zero Trust Network Access pilot replacing VPN for defined application sets. Outcome: application access is context-controlled and auditable.

“Zero Trust is not a product you switch on. It is built layer by layer. But organisations that start with identity and MFA immediately eliminate the majority of their credential-based attack surface.”

ACME Security Team