Zero Trust gets sold as a destination and delivered as a platform purchase. Both framings fail, because the hard part was never the technology. It is migrating a running business off implicit network trust without breaking the people who depend on it.
A sequence that works
- Inventory identities before applications. You cannot make per-request authorisation decisions if you do not know who the requesters are. Directory consolidation comes first.
- Make device posture observable. Not enforced. Observable. Measure how many devices would fail your intended policy before you switch it on. The number will surprise you.
- Pick one application, end to end. Something meaningful but not load-bearing. Prove the pattern: identity-aware proxy, conditional access, logging, break-glass path.
- Enforce in report-only mode first. Every major identity platform supports this. Run for a full business cycle, including month-end and whatever your seasonal peak is.
- Retire the VPN last, not first. It is the visible win, so it gets pulled forward. It should be the final step, once nothing needs it.
The break-glass path is not optional
Every enforcement control needs a documented, tested, audited way around it for the case where the control itself is what is broken. Teams that skip this either never enforce, or enforce once and get burned into never doing it again.
What to tell the board
Zero Trust is not a product you finish buying. It is a change in where the authorisation decision happens, from the network edge to each request. Framed that way, the roadmap is fundable in increments, and each increment is independently useful.