Zero Trust is a security model built on one principle: don't trust anything, verify everything. It sounds complex and expensive. Applied to small business, it's mostly a set of practical decisions about identity, device management, and access control — many of which are already available in Microsoft 365.
Traditional network security operated on a castle-and-moat model: build a strong perimeter, and everything inside the perimeter is trusted. The problem with this model is that once an attacker gets inside — through phishing, a compromised VPN, or a malicious USB drive — they can move freely across the internal network. The internal trust assumption means internal systems don't challenge or verify traffic from other internal systems.
Zero Trust eliminates this internal trust assumption. Every access request — whether it comes from inside the office or from a remote worker — is verified against identity, device health, location, and context before access is granted.
The Three Pillars of Zero Trust for Small Business
1. Verify identity explicitly: Every user is required to authenticate strongly (MFA) for every access session. Passwords alone don't grant access. Identity verification includes the user's credential, a second factor, and optionally risk signals (sign-in location, behaviour patterns). Microsoft Entra ID Conditional Access implements this for Microsoft 365 environments.
2. Use least privilege access: Users, service accounts, and applications have access only to the specific resources they need for their role — nothing more. An accounts payable clerk doesn't need access to HR files. An HR system's service account doesn't need access to the financial database. This limits what an attacker can reach if any single account is compromised.
3. Assume breach: Design your security architecture assuming that a breach has already occurred or will occur. Segment your network so a compromised device can't reach everything. Monitor for lateral movement and anomalous access patterns. Log everything so post-incident investigation is possible.
What Zero Trust Looks Like in Practice for an SMB
For a 20-person NZ professional services firm, Zero Trust implementation looks like: MFA enforced for all users on every sign-in via Conditional Access, Intune-managed devices required before accessing sensitive business data, network segmentation separating guest Wi-Fi from business systems, application-specific access permissions reviewed annually, and SentinelOne on every endpoint monitoring for lateral movement behaviour.
None of these require enterprise security teams or expensive custom implementations. They're configurations within Microsoft 365 Business Premium and standard managed IT tooling. Optimyze deploys Zero Trust principles as a standard framework for all managed clients — not as a separate product, but as the way the underlying platforms are configured.
Zero Trust isn't a product you buy — it's a design philosophy applied to how you configure the tools you already have. For most NZ small businesses using Microsoft 365, the majority of Zero Trust controls are already available, just not turned on.
