Accelerate your zero-trust journey with your existing stack

The journey to zero trust can feel overwhelming, and many organizations don’t know where to start. That’s why it’s critical to assess your current maturity level.

Leading organizations use frameworks like the Cybersecurity & Infrastructure Security Agent (CISA) Zero Trust Maturity Model, which organizes maturity across seven pillars: identity, devices, networks, applications/workloads, data, visibility and analytics, and automation and orchestration. Each pillar is evaluated across four maturity levels: traditional, initial, advanced and optimal, and this helps CISOs better understand their organization’s current state.

You can’t protect what you don’t know exists. The first step is identifying what your organization must protect—your digital crown jewels (DCJs). These typically include the following: personally identifiable information (PII), intellectual property, financial data, customer records, critical infrastructure systems and proprietary code or algorithms.

Organizations must start by engaging business and IT leaders to perform an inventory of critical data assets, as well as their locations and sensitivity. The goal is to understand who owns the data, where it resides (cloud, on-premises, Software as a Service (SaaS)), how it’s accessed and what would happen if it were leaked or tampered with. This exercise sets the foundation for a risk-aligned zero-trust strategy.

Once your DCJs are clearly defined, the next step is to map their data footprint, including storage, transmission and access points. Where is your data stored? How is it transferred across systems? Who accesses it, and through which applications, devices and networks?

One way to map your data footprint is to use something like a data flow diagram to illustrate how sensitive data moves through your ecosystem. Regardless of the method you use, the aim is to uncover shadow IT, unmanaged endpoints and unsanctioned applications that pose hidden risks.

Zero trust is context driven. As such, understanding how your users interact with DCJs is crucial to designing proper controls. Common patterns include the following: privileged users accessing production environments remotely, developers working from unmanaged devices and uploading code to Git repositories, and third-party vendors logging into internal systems via a virtual private network (VPN).

Once you clearly understand your organization’s access use cases, define the risk associated with each scenario and implement tailored controls to match risks to the correct level of protection.

Once you understand your organization’s maturity baseline, you can build a phased roadmap aligned to your organization’s goals. Typical roadmap structures include foundation, visibility and control, and deep protection.

At the foundation phase, organizations understand existing identity, data, network, application and device capabilities; replace legacy VPNs with zero-trust network access (ZTNA); enforce multi-factor authentication (MFA) across all access points; and start using identity-based segmentation.

At the visibility and control phase, organizations deploy secure web gateways for outbound traffic control; implement cloud access security broker (CASB) for SaaS and shadow IT discovery; and begin tagging and classifying sensitive data.

At the deep protection phase, organizations enforce least privilege through role-based access and just-in-time permissions; implement microsegmentation to isolate workloads and prevent lateral movement; and monitor insider threats through behaviour analytics. 

Throughout your journey, stay anchored in core zero-trust principles that guide both technical implementation and policymaking. While many teams focus on tools, success starts with a mindset shift—where no user or device is trusted by default. Help teams embrace this by building awareness of evolving threats, using real-world breach examples and connecting zero-trust practices to business goals like resilience and compliance.

Clearly communicate that breaches are inevitable and that reducing impact through least-privilege access and continuous verification is essential. Foster collaboration across security, IT and business teams to align on risk tolerance and access controls. Design systems to limit damage, grant only necessary access and adjust permissions dynamically based on real-time risk signals like location, device health and behaviour.

Most organizations begin their zero-trust implementation by modernizing legacy access systems. Older applications and infrastructure often lack the support for modern authentication, segmentation or telemetry, so organizations must plan for modernization or containment strategies for legacy systems early on.

ZTNA replaces legacy VPN, offering secure, identity-based access. Secure web gateways enforce internet usage policies and prevent data exfiltration. CASB monitors cloud data, applies data-loss prevention policies and enables compliance. Microsegmentation limits internal access and stops lateral movement by unauthorized actors. And network access control validates devices before granting access to resources.

How zero trust leads to secure access service edge (SASE)

Zero trust starts your organization’s journey towards securing what is sometimes referred to as the who, what and how. You begin by defining who should have access to what resources and under what conditions. You implement controls like identity and access management, MFA, device posture checks and segmentation.

But at this stage, your controls are still distributed, with different tools for networks, endpoints and cloud.

At this point, the need for convergence emerges. As you scale zero trust across the enterprise, managing separate security and networking stacks becomes increasingly complex. Teams face visibility gaps, overlapping tools, inconsistent policies and performance issues for remote users.

In many cases, secure access service edge (SASE) becomes the logical next step. SASE converges networking (like software-defined wide area network (SD-WAN)) and security (like ZTNA, secure web gateway, CASB and Firewall as a Service (FWaaS)) into a single, unified service fabric. It allows organizations to enforce zero-trust policies at the edge, close to the user, with performance and security. With SASE, zero trust is built into how your network operates—not bolted on.

Interested in learning more about the benefits SASE offers to organizations? Reach out to our team.

As organizations adopt zero trust, they’re integrating multiple technologies across various domains—identity, devices, data, applications, networks and infrastructure. Without a clear governance model, efforts can become fragmented, inconsistent and unscalable. 

A zero-trust governance model enables strategic alignment between business goals and security investments, consistency in policy enforcement across departments and platforms, accountability for access, data protection and risk management, and sustainability of security controls over time. Think of it as the operating system for your zero-trust journey, enabling everything to run in sync.