Every vendor selling zero trust describes it as a product. It is not. It is a set of assumptions inverted: the network is hostile, location proves nothing, and every request is authenticated and authorised on its own merits.
That inversion does not require new hardware. It requires sequencing.
Start where the identity already is
If you run Microsoft 365 or Google Workspace, you already have the control plane. The first move is not buying anything — it is making sure the identity provider is authoritative, that every application authenticates against it, and that the shadow directories nobody admits to are retired.
Applications still using local accounts are the ones that will breach you. They are also, invariably, the ones nobody wants to touch.
Sequence by blast radius, not by ease
The instinct is to start with the easy applications. The better order is by what an attacker gains from compromising each one.
- Domain admin and cloud tenant admin paths first — standing privilege is the highest-value target on the estate
- Then anything holding regulated or customer data
- Then the finance and payment path
- General productivity applications last
What "done" looks like at each stage
Conditional access enforced with device compliance. No standing admin — privilege elevated on request, time-bound, logged. Segmentation that means a compromised workstation cannot reach a database directly. Logging that a human actually reviews.
None of that is a product purchase. Most of it is configuration and decisions you have been deferring.