In short
- Identity first — one provider, MFA and conditional access closes the common paths
- Inventory what currently trusts what before redesigning any network
- Move lateral paths to brokered access before attempting segmentation
- A partially applied model beats a fully designed one that never ships
Zero trust is usually sold as a replacement programme: new identity provider, new network, new endpoint stack, eighteen months. Most organisations cannot absorb that, and the ones that try often stall halfway with two architectures running at once.
Start with identity, not the network
The highest-value move on a legacy estate is not segmentation. It is getting every authentication path behind one identity provider, with multi-factor and conditional access applied consistently. That is achievable without touching the network, and it closes the door most real-world attacks actually come through.
Then remove implicit trust, one path at a time
- Inventory what currently trusts what — most estates cannot answer this on day one
- Put the highest-value system behind explicit authorisation first
- Move lateral paths to brokered access rather than flat reachability
- Only then start on network segmentation, where it is still needed
You do not need a new network to remove implicit trust. You need to know what currently trusts what — and most estates cannot answer that on day one.
What to accept
Some systems will not participate. Equipment that cannot support modern authentication should be isolated and compensated for, rather than allowed to block the whole programme. A partially applied model is considerably better than a fully designed one that never ships.
Sequence the work so that each phase leaves the estate in a defensible state on its own. A programme that only pays off at the end is a programme that will be cancelled in the middle.
