Buying an identity tool and switching it on does not make an organization Zero Trust. That single misunderstanding is why so many “Zero Trust” rollouts stall after the first license is signed. Zero Trust is an architecture decision about how people, devices, and applications earn access — not a SKU you deploy and forget.
The model itself is well defined. The U.S. National Institute of Standards and Technology lays it out in SP 800-207, which frames Zero Trust as a set of principles applied across endpoints, services, and data flows — not a product you install. Vendors supply the components; you supply the strategy that ties them together.
Why “one IAM tool” never equals Zero Trust
Single sign-on and multi-factor authentication are essential, but they answer only one question: is this the right user? They say nothing about whether the laptop in their hands is patched, whether the request is normal for that person, or whether a compromised session is quietly moving toward sensitive systems.
Attackers exploit exactly that gap. According to Verizon’s 2025 Data Breach Investigations Report, stolen credentials were the entry point in 22% of breaches, and 60% of breaches involved a human element such as phishing or error. A valid login is now one of the cheapest things an attacker can buy. If verifying the credential is the whole of your defense, the credential becomes the whole of your risk.
That is the practical reason NIST defines seven tenets rather than naming a tool: every request must be authenticated, authorized, and evaluated per session against identity, device posture, and context. No single product covers all three.
What does a real Zero Trust transformation actually cover?
A workable strategy spans three layers that have to make decisions together, not in isolation:
- Identity — who is asking. As non-human identities grow, machine identity management becomes an important part of controlling how automated systems authenticate and access resources.
- Device trust — what they are asking from. Endpoint and mobile management (Chrome Enterprise for browser-based access, Jamf for Apple fleets) checks that a device is enrolled, encrypted, and current before it is allowed near a resource.
- Network and application access — how the request reaches the resource. A Zero Trust network layer (such as Cloudflare) brokers each connection to a specific application instead of dropping the user onto a flat internal network.
The power is in the combination. An identity check plus a device-posture check plus per-application access means a stolen password alone reaches almost nothing — the attacker still lacks a trusted device and never gets network-level reach to pivot from.
According to Maksym Shapoval, Director of Security Architecture & Security Alliances at Cloudfresh, the sequencing matters as much as the components: “The teams that succeed treat Zero Trust as a phased program, not a procurement event. We usually start by consolidating identity and killing standing access, then layer device posture and per-app network controls on top — so each phase delivers a measurable drop in exposure instead of a big-bang cutover that the business resists.”
Where does network security fit?
Identity tells you who, device posture tells you what — but the network layer decides how far a verified request can travel. This is where lateral movement gets contained: when access is brokered per application, a foothold in one service no longer opens a path to everything else on the same subnet.
It is also the layer most organizations underestimate, because legacy VPNs trained everyone to think of access as binary — inside or outside. Replacing that with application-level brokering is usually the phase where teams want outside help, whether through their existing vendor or Cloudflare Zero Trust consulting, because it touches routing, identity integration, and user experience at the same time.
How should a business sequence the rollout?
NIST is explicit that most enterprises migrate in phases rather than replacing everything at once. A pragmatic order looks like this:
- Modernize identity first. Enforce phishing-resistant MFA, centralize SSO, and remove permanent admin rights. This is the single highest-return step, since credentials drive the largest share of breaches.
- Add device trust. Make enrollment and posture a precondition for access, so an authenticated user on an unmanaged or out-of-date device is treated as untrusted.
- Broker access per application. Retire flat network access in favor of per-app connections that contain lateral movement.
- Make policy continuous. Feed identity, device, and access telemetry into decisions that are re-evaluated each session, not granted once and forgotten.
Each phase stands on its own and reduces measurable risk, which keeps the program funded and keeps users on side. That is the opposite of the all-or-nothing project that collapses under its own scope.
The takeaway for decision-makers
Treat Zero Trust as an operating strategy you build, not a box you buy. Pick tools because they fit a phase of that strategy — identity, device, network — and insist that they share signals rather than work in isolation. Start with identity, prove the risk reduction, and expand. The organizations getting real value from Zero Trust are not the ones with the longest tool list; they are the ones whose people, devices, and applications all have to prove themselves on every request.
About the author
Maksym Shapoval is Director of Security Architecture & Security Alliances at Cloudfresh, where he advises enterprises on Zero Trust architecture, identity and access management, and network security across Cloudflare, Okta, Jamf, and JumpCloud.
