Updated: Feb 25, 2026
Zero Trust is not a product. It is a control shift. Start with identity and privileged access. Delay broad network redesign until you contain admin, remote, and third-party risk.
A Bengaluru-based SaaS firm enforced perimeter firewalls, endpoint protection, and VPN access. An attacker did not break the firewall. He logged in with stolen credentials. He moved laterally using over-privileged access. No segmentation blocked him.
The board later asked one question. Why did Zero Trust not stop this?
The answer was simple. Zero Trust had not been operationalised. It had been discussed.
Zero Trust is a security model that requires continuous verification of identity, device posture, access context, and session behaviour before granting access to applications or data. In India, Zero Trust implementation typically combines identity enforcement, Zero Trust Network Access (ZTNA), and Secure Service Edge (SSE) capabilities to reduce implicit network trust. It removes implicit trust based on network location and replaces it with policy-driven access decisions.
In practical terms, Zero Trust shifts control from the network perimeter to identity and application layers.
In Indian enterprises, Zero Trust must address five structural realities:
Operational Zero Trust requires:
If these controls are not measurable, Zero Trust remains conceptual.
1. Phishing-Resistant MFA For All Privileged Users
Do not start with every employee. Start with domain admins, cloud administrators, finance approvers, and remote IT support staff.
If privileged access lacks phishing-resistant MFA, Zero Trust does not exist.
2. Remove Shared And Dormant Admin Accounts
Audit service accounts. Remove shared credentials. Rotate keys. Reduce standing privilege.
Most Indian enterprises underestimate the volume of unused elevated access.
3. Replace VPN-Based Trust With Identity-Based Access
VPN grants network access first and verifies later. Zero Trust verifies first and grants application-level access only.
Focus on external-facing admin access and critical applications. Replace broad network tunnels with policy-driven access.
4. Segment High-Value Assets
Segment finance systems, HR data, and production control networks. Limit east-west movement. Measure lateral traffic reduction.
Segmentation does not require a full network redesign on day one. It requires policy enforcement around sensitive assets.
Do not attempt enterprise-wide micro-segmentation before identity control stabilises.
Start with high-risk roles. Expand gradually.
Begin with visibility and privileged SaaS enforcement. Refine policies after baseline risk reduces. Zero Trust fails when scope overwhelms execution.
Level 1: Perimeter Dependent
Level 2: Identity-Enforced Access
Level 3: Policy-Driven Continuous Verification
You should know your maturity level. If privileged access is not tightly controlled, you remain at Level 1.
VPN assumes trust after connection. ZTNA verifies access per application. Secure Service Edge, or SSE, extends policy control across web, SaaS, and private applications with continuous inspection and identity-aware enforcement.
For Indian enterprises evaluating Cisco Secure Access, Cisco Duo, and Cisco ISE, the architectural shift lies in moving from network trust to identity and policy enforcement at every access point.
Indian enterprises moving from VPN to ZTNA typically see an immediate reduction in exposed internal services. Enterprises adopting SSE gain additional visibility across unmanaged SaaS usage and web traffic.
In Hyderabad’s IT corridor, a mid-sized technology firm moved remote admin access from VPN to identity-based application access. They enforced phishing-resistant MFA for all privileged roles, validated device posture before access, and segmented finance workloads at the network layer. During red-team simulation, lateral movement attempts failed at policy enforcement points.
The change was phased and measurable. It did not disrupt operations because high-risk identities and applications were prioritised first.
Effective Zero Trust architecture combines:
Each control must produce a measurable reduction in attack surface, not only architectural compliance.
Zero Trust fails when the scope expands too early. You need a phased execution model with measurable checkpoints.
Target outcome: 100 percent privileged account coverage with strong MFA and zero shared admin accounts.
Target outcome: Reduced exposed internal services and controlled third-party connectivity.
Target outcome: Measurable reduction in lateral movement paths and validated enforcement under test conditions.
At the end of 90 days, you should see a quantifiable reduction in exposed services, excessive privilege, and internal trust assumptions.
Within six months, you should be able to demonstrate:
Track these metrics:
If you cannot show quantitative change, your Zero Trust programme lacks operational depth.
Proactive Data Systems works with enterprises across Delhi NCR, Mumbai, Pune, Bengaluru, Hyderabad, and industrial clusters to design and implement Zero Trust architectures that integrate identity assurance, application-level access, segmentation, and SOC telemetry into one accountable model.
As a Cisco Preferred Security Partner, Proactive aligns identity enforcement, secure access, and network segmentation with measurable risk reduction and regulatory readiness.
We assess your current maturity, define a phased roadmap, deploy controls, and test them under simulation.
If you want clarity on what must change now and what can wait, request a focused Zero Trust readiness assessment. Write to [email protected] today.
