Zero Trust in Plain English: What It Means for a 20-Person Company

The phrase gets thrown around like a product you can install. It isn't. Zero Trust is a way of deciding who gets in, and the version that matters for a twenty-person company is more practical, and cheaper, than the marketing suggests.

The idea in one sentence

Stop assuming anything inside your network is safe. Verify every request, every time.

That's it. Everything else is implementation.

What it's replacing

For twenty years the model was a hard shell and a soft center. Build a firewall, hand out a VPN, and trust anything that got inside. Once you were on the network, you were in.

That model assumed people worked in one building, applications lived in a server room, and the network edge was where security happened. None of that is true anymore. Your team works from home and coffee shops. Your applications live in Microsoft 365 and half a dozen cloud services. Your data sits on laptops and phones you don't own.

Worse, the old model has a single point of failure: one stolen password. An attacker who gets valid credentials suddenly looks like a trusted insider, because the network trusts anyone who logged in.

Zero Trust removes that assumption.

The three moves that actually matter

1. Identity is the new perimeter

Where the network used to be the boundary, your login is now the boundary. That means:

• Multi-factor authentication everywhere, starting with email and administrative accounts
• Conditional access, so the right login from a managed device in a reasonable location gets in
• One identity per person, with no shared logins and no generic accounts everyone knows the password to

2. Least privilege

Everybody gets the access their job needs, and nothing more. Practically:

• Separate administrator accounts, used only for administration
• No standing admin rights on daily accounts
• Access reviewed on a schedule, because roles change and permissions don't on their own

3. Assume breach

Plan as if something will eventually get through, because something eventually does:

• Logging and monitoring that someone actually reads
• Endpoint detection and response rather than antivirus alone
• Backups that have been tested, not just taken

What you don't need

You don't need a product named Zero Trust. You don't need a six-figure program or a consultant with a slide deck about maturity models.

Zero Trust is not a purchase. It is the consistent application of fundamentals you can mostly do with tools you already own. Microsoft 365, Entra, and Intune cover a surprising amount of ground.

A realistic sequence for a twenty-person company

1. Turn on MFA for everyone, no exceptions, especially email and admin accounts.
2. Eliminate shared accounts and generic logins.
3. Configure conditional access so only managed, compliant devices reach company data.
4. Give administrators separate accounts.
5. Manage and encrypt devices, and enforce patching.
6. Turn on logging and endpoint detection.
7. Test your backups by restoring something.
8. Review who has access to what, once a quarter.

None of these steps is exotic. Together they make up most of what Zero Trust means in practice.

Where small businesses get stuck

The failure is almost never the technology. It's the exceptions:

• An MFA exemption for one executive that quietly becomes permanent
• A shared password for a service account that everyone has memorized
• Conditional access configured and left in report-only mode forever
• Access reviews that never happen because nobody owns them
• Tools purchased and licensed but not actually turned on

Zero Trust fails in the gap between "we bought it" and "we configured it, enforced it, and review it." Closing that gap is less about budget than about someone owning it.

The bottom line

Verify every request. Give people the least access they need. Assume something will get through, and be ready for it.

Do those three things consistently at twenty people and you'll be in better shape than most companies ten times your size.