Where the risk shows up
Zero Trust often fails when treated as a tool rollout. In practice, it is about verifiable access, least privilege, strong identities, segmented networks and usable telemetry.
A pragmatic entry point prioritizes critical applications, privileged access and known lateral movement paths.
Checks worth doing
- Model critical access first
- Reduce legacy protocols and old openings
- Secure administrative paths separately
- Align segmentation with business risk
- Deliver measurable controls instead of slogans
What gets better
- Access decisions use identity, device, location, risk and target system instead of network location alone.
- Critical applications get a clearer protection model than generic office or web access.
- Old trust assumptions become visible, such as VPN equals internal or admin equals allowed everywhere.
Where it can hurt
- Zero Trust becomes expensive and slow when treated as a product program instead of architecture work.
- Too many exceptions make policies unreadable and hard to audit later.
- Without clean device and identity inventory, decisions stay vague.
Checks before rollout
- Which applications and admin paths are truly critical?
- Which signals are reliable: MFA, device, risk, network, role?
- Which legacy protocols bypass the target state?
- How are exceptions time-boxed, reviewed and removed?