What Is Zero Trust — and Does a 20-Person Business Need It?

Zero trust may be the most marketed phrase in security, stamped on everything from firewalls to coffee mugs. Strip the branding and one idea remains: stop assuming anything is safe because of where it is. Being inside the office network, or being a known laptop, earns nothing — every access gets verified.

Why the old model broke

The traditional "castle and moat" design trusted everything inside the walls. Then work left the building, apps moved to the cloud, and attackers learned that one phished password put them inside the moat with the drawbridge up behind them. Flat, trusting internal networks are why one compromised laptop so often becomes a whole-business incident.

Zero trust, SMB edition

• Verify identity strongly: MFA everywhere, conditional access rules on sign-ins.
• Least privilege: staff get access to what their role needs — not the whole shared drive; admin rights separated from daily accounts.
• Assume breach: segment what you can (guest Wi-Fi separate, critical systems restricted) so one compromised device isn’t a skeleton key.
• Monitor: log and watch sign-ins and endpoints so odd behaviour surfaces fast.

So — does a 20-person business need it?

You don’t need the enterprise architecture project. You almost certainly already need the principles — and if you’ve implemented MFA, least privilege and monitored endpoints, congratulations: you’ve been doing zero trust without buying anything labelled zero trust. Treat the term as a direction of travel, not a product category, and be suspicious of any quote where the words cost extra.