Zero Trust has a branding problem: it sounds like a year-long, seven-figure re-platforming project, which is why most mid-market teams keep putting it in next year's budget. In reality it is a set of principles you can adopt incrementally - never trust, always verify, assume breach - and the order you adopt them in matters more than the tooling you buy.
Start with identity, because it is the control with the best return per rupee spent. Strong multi-factor authentication everywhere, and a single source of truth for who works here and what they are allowed to touch, buys you more risk reduction than any other single change. Most breaches we are called in after did not begin with an exotic exploit; they began with a valid password used by the wrong person. Phishing-resistant factors matter here - one-time codes over SMS are better than nothing and worse than a hardware key or a passkey.
Then segment the network, so that a breach in one place cannot wander into everything else. You do not need microsegmentation of every workload to get value. Separating the finance systems from the general office network, and the production environment from the laptops that developers browse the web on, closes the paths attackers use most. Segmentation is what turns an incident into a contained incident.
Third comes device posture. Access decisions should account for what the device is - patched, encrypted, managed - and not only who is holding it. Roll this out in report-only mode first. Watch for a few weeks, see which devices would have been blocked and why, fix those, and only then start enforcing. Turning posture checks on cold is the fastest way to have the whole programme paused by an angry executive who cannot open email.
Fourth are least-privilege access reviews. Permissions accumulate: people change teams, cover for someone, join a project, and the access follows them forever. Review by system rather than by person, expire access by default rather than granting it permanently, and make elevation temporary and logged. This is unglamorous work with no product to buy, and it is consistently what auditors find first.
The sequencing is the point. Each of those four phases delivers something defensible on its own, so the programme survives budget cycles, leadership changes and the quarter when everything gets deprioritised. A Zero Trust project that must be finished to be worth anything will not get finished. One that reduces measurable risk every quarter tends to keep its funding - which is why phased rollouts are the ones that actually stick.
