Zero Trust Architecture (ZTA) – How to Implement It Step by Step Without the Vendor Hype

Updated: 15 September 2026

What is Zero Trust Architecture? Zero Trust Architecture (ZTA) is a security model that eliminates implicit trust in any user, device, or network segment – regardless of whether they sit inside or outside the traditional network perimeter. The principle “never trust, always verify” originates from a Forrester Research report by John Kindervag (2010) and addresses the fundamental weakness of the perimeter model: it assumes that threats come from outside. 

Verizon DBIR 2024 shows otherwise – the human element was present in 68% of all breaches, and stolen credentials combined with lateral movement after initial compromise are the vectors that a perimeter alone cannot stop. NIST Special Publication 800-207 (2020) defines seven principles of ZTA and is the baseline document for any organisation planning an implementation.

Zero Trust Implementation – at a glance:

1. Zero Trust is not a product or a single technology – it is an architectural strategy delivered through a combination of controls across five pillars: Identity, Device, Network, Application, and Data; no single vendor delivers “complete ZTA”
2. The fastest and most impactful starting point is the Identity pillar: strong authentication (MFA), device health verification, and Conditional Access Policies – already available in Microsoft Entra ID or Google Workspace with appropriate licensing
3. Full ZTA implementation for a mid-market organisation typically takes 2 to 4 years across multiple phases – a six-month project can cover one pillar, not the entire architecture
4. CISA published a Zero Trust Maturity Model with levels from Traditional through Initial, Advanced, to Optimal per pillar – a practical maturity roadmap for organisations at any starting point
5. Microsegmentation (Network pillar) without strong identity governance (Identity pillar) does not deliver ZTA – the sequencing of pillars matters
6. Patronusec, as a vCISO partner, conducts ZTA readiness assessments and helps organisations prioritise investment based on their existing technology stack – without requiring new product purchases before the assessment

---

---

Why does the traditional perimeter model fail against today’s dominant attack patterns?

In the perimeter model, trust in a user or device derives from network location – if you are on the internal network or connected via VPN, you have access. This model has one structural weakness: an attacker who is inside the network (through phishing, stolen credentials, or a compromised supplier) has the same level of access as a legitimate user.

How ZTA addresses the primary attack vectors:

Stolen credentials: In the perimeter model – an attacker with a valid VPN password enters the network and moves laterally. In ZTA – every session requires verification: MFA, device health (is this a managed device?), location (is this a typical location?), and session risk scoring. Any deviation triggers additional verification or blocks access entirely.

Lateral movement after endpoint compromise: In the perimeter model – a compromised laptop means access to the entire internal network. In ZTA – microsegmentation contains the compromise; access to adjacent systems requires fresh authorisation; EDR can isolate the device upon anomaly detection.

Supply chain and third-party access: In the perimeter model – a partner’s VPN access is access to the internal network. In ZTA – a partner’s access is scoped to a specific application, from a verified device, during defined hours, with full logging.

Insider threat: In the perimeter model – an employee with access rights to a server can copy data without triggering an alert. In ZTA – Just-In-Time access, Data Loss Prevention, and behavioural anomaly detection constrain and surface unexpected data movement.

Patronusec Insight: The most common question from clients considering Zero Trust is “which product do we need to buy to implement ZTA?” The answer is consistently: start by assessing what you already have. Microsoft 365 with Entra ID and Conditional Access Policies, Google Workspace with Context-Aware Access, AWS IAM with Service Control Policies – these are ZTA primitives already present in most organisations, waiting for proper configuration. In our vCISO service, we conduct a ZTA readiness assessment that identifies what can be configured without new purchases and what delivers the highest return on security investment.

---

Want to know where you stand on the Zero Trust maturity model and what the next step should be at minimal cost?

Patronusec conducts ZTA readiness assessments – a maturity evaluation per pillar with a concrete action roadmap based on your current technology stack.

Book a ZTA readiness assessment

---

How do you implement Zero Trust – the five-pillar sequence?

NIST SP 800-207 defines ZTA through seven principles, but for practical implementation, thinking in five sequenced pillars is more actionable.

Pillar 1 – Identity (highest priority)

Identity is the new perimeter. According to IBM X-Force 2024, stolen credentials were the initial access vector in 46% of incidents in the financial sector. A strong identity posture reduces the most prevalent attack vector.

Pillar 2 – Device

Every device must meet a minimum baseline: managed via MDM or Endpoint Management, patch level current, EDR installed and active, disk encryption enabled. Access is denied to devices that do not meet the baseline.

Pillar 3 – Network (microsegmentation)

Internal networks divided into micro-segments with minimal permitted flows between them. East-west traffic monitored and logged. No lateral movement without explicit authorisation.

Pillar 4 – Application

ZTNA (Zero Trust Network Access) replaces VPN: access to a specific application, not to the entire network. Application-level authentication for every API call.

Pillar 5 – Data

Data classification and labelling, Data Loss Prevention (DLP), encryption at rest and in transit as a baseline requirement, and audit logging of all data access events.

A quick ZTA maturity self-assessment for the Identity pillar:

Current state	ZTA maturity level
Passwords without MFA, no access reviews	Traditional (level 0)
MFA for administrators only, no Conditional Access	Initial
MFA for all accounts, Conditional Access, regular access reviews	Advanced
Just-In-Time access, anomaly detection, continuous session risk monitoring	Optimal

When is Zero Trust justified – and when is it overkill?

ZTA is justified when:

• Hybrid or remote-first working model with no meaningful traditional perimeter
• External partners, suppliers, or BYOD users require access to internal systems
• You process sensitive data subject to regulation (PCI DSS, DORA, NIS2, ISO 27001)
• The dominant attack patterns in your sector are phishing, credential theft, and lateral movement – which describes most sectors today

ZTA may be excessive when:

• Below 50 staff, all systems on-premises, zero external access – here, correctly configured MFA, current patches, and reliable backups deliver the most risk reduction per pound spent
• Budget and capacity do not allow a coherent multi-pillar implementation – a partial ZTA without consistency across pillars can be less effective than a well-maintained traditional model

Patronusec Insight: Organisations regularly ask whether Zero Trust “counts towards” PCI DSS, ISO 27001, or NIS2 compliance. The answer is yes – ZTA naturally satisfies multiple requirements simultaneously. PCI DSS Requirement 7 (least privilege) maps directly to the ZTA Identity pillar. Requirement 1.3 (CDE segmentation) maps to the Network pillar. Requirement 8.4.2 (MFA for all CDE access, mandatory from 31 March 2025) maps to the Identity pillar. Implementing ZTA in cloud environments typically simplifies PCI DSS compliance – and that is an argument worth putting to the board when building the business case for investment. We can help you map ZTA to your specific regulatory obligations during a free consultation.

FAQ – Zero Trust Implementation

---

Zero Trust Architecture – free consultation

Patronusec, as a vCISO partner, conducts ZTA readiness assessments and helps organisations plan Zero Trust Architecture implementation based on their existing technology stack.

In a free 30-minute consultation we will help you:

• Evaluate current ZTA maturity per pillar (Identity, Device, Network, Application, Data)
• Identify the pillar with the highest risk-reduction impact at the lowest cost for your environment
• Propose an implementation sequence based on your existing stack (Microsoft 365, Google Workspace, AWS, Azure)
• Map ZTA to your PCI DSS, ISO 27001, or NIS2 obligations as a business case for the board

Free consultation | vCISO service | Penetration testing | ISO 27001 | NIS2