Zero Trust for a 50-Person Business, Without the Vendor Slideware

Zero trust for a fifty-person business is one decision applied everywhere: stop granting access on the basis of where the request came from. It is not a product. The Australian Signals Directorate (ASD) says so more bluntly than most vendors will. Its guidance states that this architecture cannot be bought off the shelf as a single product, service or specific toolset. Its ten foundations open on centrally managed identities, not on hardware. A Cyber Strength Audit opens on the same ground: who can reach what, from where, and with what protection. inSUPPORT has run more than 1,500 of them for Australian businesses.

If the term makes you wince, that is earned. Zero trust arrives attached to a slide deck, a platform licence and a diagram with your business in the middle. Nobody at fifty users has budget for an architecture programme. Nobody enjoys admitting they cannot tell which part of the pitch was the security.

The reality is that most published zero trust material was not written for you. ASD's foundations document assumes an advanced level of computing and cyber security knowledge, and names enterprise architects as its readers. That does not make it irrelevant. It means the translation step is yours.

Done at fifty users on a Microsoft 365 estate, that translation comes out as a short list of ordinary work and a longer list of enterprise apparatus you can decline.

TL;DR: What to remember

• ✅ Zero trust is a principle, not a purchase. ASD states plainly that this architecture cannot be bought off the shelf as a single product or toolset.
• ✅ Three principles sit underneath it: never trust and always verify, assume breach, and verify explicitly. The rest is implementation.
• ✅ Network-level access is the thing being retired. The unit is this person, on this device, reaching that one application and nothing else behind it.
• ✅ At fifty users the achievable list is short: one identity directory, no standing administrator access, per-application access instead of a broad remote path, and an asset list that is current.
• ✅ ASD's own advice is to get a higher Essential 8 maturity level working while the architecture is planned. Adoption is a generational approach, in its words.

Contents

• What Zero Trust Actually Means, Once the Slideware Is Gone
• The Unit of Access Is the Application, Not the Network
• Which Parts Are Achievable at Fifty, and Which Are Theatre
• Zero Trust Questions Australian Operators Actually Ask

What Zero Trust Actually Means, Once the Slideware Is Gone

Trust nothing is the whole of it. Not an AI agent, not a guest, not a staff member, and not a device that happens to be sitting in your office. ASD's guidance, developed with international partner agencies, sets out three principles it takes from the US National Security Agency: never trust and always verify, assume breach, and verify explicitly. The middle one is the uncomfortable one. It means operating as though somebody is already inside, and designing so that being inside buys an attacker less than it does today.

Almost everything else follows from that second principle. If you assume the attacker is already past the front door, the question stops being how high the wall is. It becomes what the person who got in can actually reach. Nobody defends a castle with a moat any more, and the reason is not that walls were silly. It is that the attacker stopped arriving by the road the wall was built across.

Your staff work from home, your applications sit in somebody else's data centre, and your contractors are on their own laptops. There is not much inside left to be inside of. ASD puts the limit plainly: in a zero trust architecture, trust is never assumed and should not be based on network location, device, or user identity alone. Read that last clause twice, because it cuts both ways. Identity is the control plane. Identity on its own is still not the answer.

The Firewall Is Not the Reason You Are Safe

None of this makes a firewall a waste of money. A firewall is a bridge. Open, and traffic crosses; closed, and it does not. That is a genuinely useful thing to own. It is a poor thing to lean on, because the decision it makes is about a boundary rather than about a person. It cannot judge whether this user, on this laptop, should be opening that application right now. Keep it, maintain it, and stop treating it as the reason you are safe. Whether your multi-factor authentication would actually hold is the next question down, and it deserves its own read.

The Unit of Access Is the Application, Not the Network

Network-to-network trust is finished as a design. Being on the right subnet, or at the right site, no longer decides what you can reach. Segmentation still earns its place as a second wall, but the decision moves to this user, reaching that application. The difference is concrete and you can see it in your own setup. A traditional remote-access VPN checks the person once, then hands their device a route onto your network. From there it reaches everything else that has not been separately locked down. Take over one of those sessions and what you inherit is the network. That is the design working as intended rather than a misconfiguration, which is why tightening the firewall rules around it does not help.

Per-application access inverts that. Microsoft's deployment documentation for Entra Private Access describes the goal as point-to-point access to private applications across all ports and protocols. It says that approach prevents an attacker moving laterally or scanning ports across the corporate network. Each application becomes its own container, with its own access policy and its own list of who is assigned to it. The person is granted the one system rather than the room it sits in.

Several vendors sell this capability under several names, and the names change faster than the idea does. The architecture underneath them is the same. So is the question worth putting to any vendor who raises it: what does a successful sign-in actually reach? If the honest answer is the whole network, the product on the table is a VPN with better branding.

The Inventory Problem Nobody Quotes For

Before any of that there is a list to write, and it is the reason these projects slip. Microsoft's own guidance says to start by duplicating the VPN, then discover the application segments staff use, then narrow to per-application access and switch the broad path off. That order exists because most businesses cannot say which addresses and hostnames their people actually reach. ASD's reliable asset inventory foundation is the same problem stated as a design principle. Licensing also varies by tenant, so get a straight answer on what yours includes before a migration goes into a plan. Identity and access is the first area inSUPPORT assesses in the onboarding audit, for exactly this reason.

Which Parts Are Achievable at Fifty, and Which Are Theatre

ASD is candid about the cost. Architectural improvement takes significant time, resources and investment, it says, and adoption likely represents a generational approach touching virtually every system, application and user access point. Its advice in the meantime is not to wait. It is also not to start at the top. Harden what already exists using prioritised mitigation strategies, because an organisation working towards a higher Essential 8 maturity level will be well placed to adopt the architecture guidance later. That is the Australian government telling a fifty-person business to do the basics first. It is also the order that spends your money in the right sequence, because every architectural decision you make later assumes those controls are already working underneath it.

The achievable list at your size is short, and every item on it is ordinary work:

• One authoritative place where identities live, so there is a single list to add to and remove from.
• No standing administrator access. Elevate when there is a reason, record it, then take it back.
• Per-application access for the private systems still sitting on your own network, replacing the broad remote path.
• Device condition as a condition of access, so an unmanaged laptop is not treated like a managed one.
• A current asset and application list, because every control above it depends on knowing what exists.

What You Can Decline Without Apologising

Four of those five need no architecture programme. Three are configuration, though two of those lean on licences you may or may not already hold. Device condition as a test of access assumes your laptops are enrolled in device management, which is Intune in most Microsoft shops, and taking admin rights on demand is Privileged Identity Management, which sits in the higher Entra ID licence. Check both against what you pay for before you plan them. One is a spreadsheet, and only the move to per-application access is a project, for the inventory reason above. The rest of the apparatus is an enterprise answer to enterprise scale. A policy engine scoring behavioural analytics continuously, microsegmentation of a flat office network down to the workload, a governance function nobody at fifty people is free to staff. Decline all of it, and say why.

One decision does deserve your full attention, and it is which platform the identities live in, because everything above hangs off it and you choose it once. ASD's procurement guidance is worth reading before that signature. It asks for risk management before the purchase and after it, and notes that procuring any digital product or service increases your attack surface. The foundations guidance cited here read "Last reviewed 23 Oct 2025" when it was checked on 20 October 2026. On 15 October 2026 ASD published the ASD Essentials, written primarily for Commonwealth entities, critical infrastructure and large organisations, and said that Essential 8 work already completed remains relevant, that it does not recommend slowing or stopping current uplift, and that it will advise on expectations for transitioning in due course.

Zero Trust Questions Australian Operators Actually Ask

Do we really need zero trust at fifty people?

You need the principle. You do not need the programme. Zero trust means access is granted on verified identity and context rather than on network position, and that holds at fifty users exactly as it does at five thousand. What changes is the scale of the implementation. ASD's architecture guidance is written for enterprise architects, assumes advanced knowledge, and says plainly that the approach cannot be bought as a single product. At your size the work is a short list of ordinary changes to identity, access and inventory, and most of it is overdue rather than advanced.

Should our IT provider be doing this, and what do we ask them for?

Ask for artefacts rather than assurances. The list of people holding administrator rights, with a reason beside each name. The list of private systems reachable through the remote-access path, and what a successful sign-in on that path can open. The asset and application inventory as it stands today, not as it could be written up this week. A provider running your environment should produce all three without preparing them first. If zero trust appears in a proposal as a product line with a monthly price, ask which of those three lists it changes.

How long does this take, and what changes first?

Identity first, because every later step depends on it and it is usually the quickest. Removing administrator rights nobody needs, and closing accounts belonging to people who have left, is days of work rather than a project. Replacing broad network access with per-application access depends entirely on how many private systems you still run. Microsoft's own guidance expects a phased deployment with a pilot group and a rollback plan rather than a cutover. Anyone quoting you a date before the inventory exists is guessing.

We have a VPN and a firewall and not much else. Where do we start?

With a list, not a licence. Write down every system someone can reach through the remote-access path, every account holding administrator rights, and every application that holds customer information or moves money. That exercise takes an afternoon and it will tell you more than any vendor assessment, because it is the inventory every later decision depends on. Keep the firewall. It still does its job at the boundary. Then get an outside look at identity and access, so the list you act on is one somebody checked rather than one you assembled from memory.

Sources

• "Foundations for modern defensible architecture", Australian Signals Directorate. The three zero trust principles of never trust and always verify, assume breach and verify explicitly, taken from the US National Security Agency; the statement that trust is never assumed and should not be based on network location, device or user identity alone; the ten design foundations beginning with centrally managed enterprise identities and including reliable asset inventory; the audience statement naming technical security architects and an advanced level of knowledge; and the advice that architectural improvement takes significant time, resources and investment while organisations work towards a higher Essential 8 maturity level. Published 10 February 2025, last reviewed 23 October 2025. cyber.gov.au
• "Modern defensible architecture for senior decision-makers", Australian Signals Directorate. That this architecture is more than a one-time IT fix and cannot be bought off the shelf as a single product, service or specific toolset; that zero trust is a departure from traditional fixed perimeter-based defence and assumes threats can originate from anywhere, including inside the network; and that adoption likely represents a generational approach touching virtually every system, application and user access point. Published 23 October 2025. cyber.gov.au
• "Choosing secure and verifiable technologies: Executive guidance", Australian Signals Directorate. Risk management before and after a technology purchase, and the statement that the procurement of any digital product or service increases the attack surface of an organisation's information environment. Published 5 December 2024. cyber.gov.au
• "Frequently asked questions (ASD Essentials series)", Australian Signals Directorate. That the Essentials series is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations; that efforts already completed under the Essential Eight remain relevant; that ASD does not recommend slowing or stopping current uplift programs; and that ASD will advise on expectations for transitioning to the new framework in due course. Published 15 October 2026. cyber.gov.au
• "Microsoft Global Secure Access Deployment Guide for Microsoft Entra Private Access", Microsoft Learn. Per-application access described as point-to-point access to private applications with all ports and protocols, preventing lateral movement or port scans on the corporate network; VPN replacement as the primary scenario; and the phased sequence of duplicating the VPN first, discovering application segments, then moving to per-app access, with a pilot group and a documented rollback plan. learn.microsoft.com
• "Learn about Microsoft Entra Private Access", Microsoft Learn. Each app acting as a container for the private resources being secured, with its own private network connector, user and group assignment, and Conditional Access policies controlling access to it. Dated 12 March 2026. learn.microsoft.com

Related Reading

• Cyber Strength Audit
• MFA Is Not a Checkbox: The Gap Australian SMEs Still Have
• Do Not Roll Out Copilot Until You Have Checked Who Can See What
• Essential 8 Maturity Level 1, 2 or 3: Which Do You Need?
• The 6 Step Cyber Strength System

Content reviewed by Probably Genius for accuracy and relevance.

inSUPPORT provides managed IT and cyber security services. It is not an insurer, insurance broker or underwriter and does not hold an Australian Financial Services Licence. Where cyber insurance forms part of a plan, it is arranged through licensed insurance partners and underwritten by the insurer. Cover is subject to the insurer's assessment, the policy terms and the Product Disclosure Statement and Target Market Determination. This article is general information about IT and security practice, not financial product advice, and it does not take account of your objectives, financial situation or needs.