Zero trust gets sold as a product category. It is closer to an assumption: that being inside the network proves nothing about whether a request should be allowed.
What the assumption forces
If location proves nothing, then every request needs identity, and every identity needs to be checked against what it is currently allowed to do. That has consequences that are organisational before they are technical: someone has to know who should have access to what, and that knowledge has to be current.
The order that works
- Inventory first. You cannot protect systems you have not enumerated, and most organisations are surprised by the count.
- Strong authentication next, everywhere, including the internal tools people assume are safe.
- Then least privilege, granted per service rather than per network segment.
- Then logging that a human will actually read, or an alert that reaches someone on call.
The part teams skip
Access removal. Most organisations are good at granting and poor at revoking. A leaver whose credentials still work is a bigger exposure than an unpatched server, and it is free to fix.