Zero-trust isn't just for Fortune 500s. In fact, mid-sized companies are the most vulnerable — big enough to be targeted, small enough to lack a dedicated SOC. Here's a pragmatic 90-day plan we've executed for 15+ SMBs.
Week 1–2: Identity foundation
- Enforce MFA across all admin accounts (Okta, Entra ID, or Google Workspace).
- Eliminate shared credentials — one human, one identity.
- Enable conditional access based on device, location, and risk score.
Week 3–6: Device posture & segmentation
- Deploy a lightweight EDR agent on every endpoint (SentinelOne, CrowdStrike).
- Segment the network: guests, IoT, employees, servers.
- Block lateral movement between endpoints; all traffic goes through a policy proxy.
Week 7–10: Application access via ZTNA
- Replace VPN with Cloudflare Access or Zscaler Private Access.
- Application-level access instead of network-level.
- Session logging, anomaly detection, automatic revocation.
Week 11–12: Monitoring & training
- Centralize logs into a SIEM (Wazuh is free, Splunk is thorough).
- Phishing simulation campaigns — you're the weakest link until proven otherwise.
- Tabletop exercises for incident response.
Post-rollout stats from our SMB clients: 89% reduction in phishing-related incidents, 76% faster incident response, and zero breaches in 12 months.
