Author: Ami DePierro | Co-Founder, 2 Dog Digital
Ami DePierro is Co-Founder of 2 Dog Digital and a former US Marine Intelligence Analyst who brings analytical precision to cybersecurity strategy for small and mid-sized businesses across the Raleigh/Triangle area. Digit is the voice. Ami is the author.
Nobody called it Zero Trust when the attack happened. They called it a Tuesday.
Twelve people worked at a manufacturing company outside Raleigh. Like a lot of small businesses, they had one shared administrator account. Three employees knew the password. A vendor had it too. Nobody remembered exactly when it was shared, and nobody changed it after the previous IT provider left.
At 2:00 a.m., someone logged in from an IP address in Eastern Europe using those same credentials. By the time employees started arriving a few hours later, the file server was encrypted.
That wasn’t bad luck. It wasn’t sophisticated hacking, either. It was a business trusting something that should have been verified.
That’s what Zero Trust for small business is really about. Not expensive hardware. Not another security product. It’s about making sure one forgotten account, one old vendor login, or one stolen password can’t hand over the keys to your business.
What Zero Trust Security Actually Is
Zero Trust is a way of deciding who gets access to your business systems and what they’re allowed to do once they’re get there. Every request has to earn that trust. It doesn’t matter whether it comes from the office, someone’s kitchen table, or halfway around the world.
The National Institute of Standards and Technology (NIST) describes Zero Trust in Special Publication 800-207 as a model where no user, device, or connection is trusted automatically. Every request is evaluated before access is granted.
That’s the part most people miss.
For years, cybersecurity worked like a building with a security guard at the front door. Once you got inside, you could wander around without anyone asking questions. That worked when everyone sat in the same office and all the computers stayed on the same network.
Then laptops went home. Cloud applications showed up. Employees started working from coffee shops, airports, client offices, and spare bedrooms. Vendors needed remote access. The office stopped being the security boundary.
Zero Trust changed with it.
Instead of asking, “Are you inside the network?” it asks, “Who are you? Is this an approved device? Should you have access to this resource right now?”
That’s what “never trust, always verify” actually means. It isn’t a slogan. It’s a design decision that assumes passwords can be stolen, devices can be compromised, and mistakes happen. Verification happens every time because yesterday’s approval doesn’t guarantee today’s request is legitimate.
Is Zero Trust Only for Large Companies?
I’ve heard this one more times than I can count. Someone finds out we’re recommending Zero Trust and says, “We’re only a small business. That’s for government agencies and Fortune 500 companies.”
Unfortunately, attackers don’t see it that way.
Verizon’s 2026 Data Breach Investigations Report found that about 96% of ransomware cloud victims, where organization size was known, were small and medium-sized businesses. The attackers aren’t choosing victims based on company size. They’re looking for compromised credentials, unpatched systems, and weak security controls.
That’s why Zero Trust scales so well. A twelve-person manufacturing company doesn’t need the same security architecture as a twelve-thousand-person enterprise, but it absolutely needs to verify who’s accessing its systems, limit unnecessary access, and keep one compromised account from becoming a company-wide problem.
CISA publishes free Zero Trust guidance specifically for small organizations because these principles aren’t reserved for enterprises. You don’t need an enterprise budget or a dedicated security team to get started. What you do need is a plan for verifying access, limiting permissions, and reducing the damage a single compromised account can cause.
The Three Things Zero Trust Actually Requires
Every Zero Trust implementation comes back to the same three principles. The technology may change, but the foundation doesn’t.
Verify explicitly. Every request for access should be evaluated based on the user’s identity, the health of the device they’re using, and the context of the request. Verification doesn’t stop after someone signs in. It continues each time they access a system or resource.
Use least privilege access. People should have access to what they need to do their jobs and nothing more. Remember the vendor from the opening story? They only needed access to three folders. Instead, they had administrative credentials that opened every door in the building.
Assume breach. Build your environment as though an attacker will eventually get in. Segment your network, monitor activity, and configure alerts so that one compromised account or device can’t move freely through the rest of your business.
That last point matters because attackers don’t always get in the same way. Verizon’s 2026 Data Breach Investigations Report found that exploiting vulnerabilities is now the most common initial access vector in confirmed breaches. Stolen credentials, phishing, and unpatched systems are all common ways attackers gain a foothold. Zero Trust assumes any one of those defenses can fail and limits what an attacker can do next.
Every Zero Trust deployment looks a little different because every business is different. The tools you use will vary, but those three principles remain the same: verify explicitly, use least privilege, and assume breach.
Digit’s Rule 13: If everyone has access, nobody has control.
Rule 13 isn’t just a catchy saying. It’s exactly what made the opening story possible. A shared administrator account meant multiple people had the same credentials, no one could prove who logged in, and the attacker inherited unrestricted access the moment those credentials were compromised.
What Zero Trust Looks Like in a Real Small Business
Let’s go back to that manufacturing company from the beginning of this article. Here’s what their environment looks like after implementing Zero Trust. Not a theoretical example, but a practical one.
Every employee has their own account. Multi-factor authentication (MFA) is required for every login, including the owner’s. There are no shared credentials and no exceptions. If you’re unfamiliar with MFA, it’s the second step that verifies your identity after you enter your password, usually through an authentication app or text message. It’s one of the simplest and most effective ways to reduce the risk of stolen passwords.
Devices must meet security requirements before they’re allowed to connect to company resources. A personal laptop that hasn’t been patched or a computer that fails security checks doesn’t get access until the issue is resolved. Identity, device health, and security policies work together to make that decision automatically.
Vendors and contractors receive their own accounts with access only to the resources they need. Their permissions are reviewed regularly, and when the work is finished, access is removed. They don’t keep a permanent key to the building just because someone forgot they existed.
The network is segmented so critical business systems are separated from one another. If a workstation is compromised, it shouldn’t provide a direct path to accounting, production equipment, or your file server.
Zero Trust and Microsoft 365 — What You Already Have
Microsoft 365 Business Premium includes many of the tools needed to support a Zero Trust strategy, but having the licenses isn’t the same as having Zero Trust. The value comes from how those tools are configured and how they work with the rest of your security environment.
Microsoft’s Zero Trust guidance follows the same principles outlined by NIST: verify explicitly, use least privilege, and assume breach. Business Premium includes capabilities such as Conditional Access, Microsoft Defender for Business, Intune device management, and Microsoft Entra ID to help put those principles into practice.
Those tools are only part of the picture. They should work alongside technologies like ThreatLocker, firewalls, endpoint protection, secure email, DNS filtering, and reliable backups to create multiple layers of defense. Zero Trust isn’t built by turning on one feature. It’s built by making your security tools work together.
If your IT provider can’t explain how your Conditional Access policies are configured, who has administrative access, or how vendor accounts are managed, those are good questions to ask. Zero Trust isn’t about checking a box. It’s about understanding who can access your systems, under what conditions, and how that access is controlled.
The First Steps to Zero Trust for Your Business
You don’t have to overhaul your entire network to get started. Focus on the basics first.
Step 1: Audit your accounts. Create a list of every employee account, administrator account, service account, and vendor account. Look for shared credentials and accounts that belong to people who no longer work with your company.
Digit’s Rule 21: The account you forgot about is the one an attacker is hoping you forgot about.
Forgotten accounts are one of the easiest ways into a network because nobody is watching them anymore. If an account isn’t needed, disable it. If it is needed, make sure it’s secured and reviewed regularly.
Step 2: Turn on MFA everywhere. Protect Microsoft 365, your banking portals, business applications, remote access tools, and your domain registrar. If a system doesn’t support multi-factor authentication, ask the vendor why. It may be time to consider a better solution.
Step 3: Tighten access. Ask one simple question for every account: Does this person need access to this? Remove unnecessary permissions, eliminate shared accounts, and make sure vendor access is limited and removed when it’s no longer needed.
Step 4: Strengthen your endpoints. Every device connecting to your business should be protected with modern endpoint security, monitored for suspicious activity, and configured to prevent unauthorized software from running. Whether you’re using Microsoft Defender, ThreatLocker, or other security solutions, your endpoint protection should be part of a layered security strategy, not a standalone tool.
Step 5: Get a second set of eyes. Even well-managed environments develop blind spots over time. A cybersecurity assessment can identify unnecessary access, outdated configurations, and security gaps before someone else finds them.
You don’t need a new server or a six-month project to start improving your security. Most businesses can begin making meaningful progress by auditing accounts, enabling MFA, and tightening access permissions this week.
What Digit Wants You to Take Away
Zero Trust isn’t a product. It isn’t something you buy once and forget about. It’s a different way of thinking about security.
Instead of assuming every user, device, or application should be trusted, you verify every request, limit access to what’s actually needed, and plan for the possibility that something will eventually go wrong.
Most small businesses already have many of the tools they need to move in that direction. The challenge isn’t buying more technology. It’s making sure the technology you already have is configured correctly, reviewed regularly, and working together.
Attackers don’t usually break in through sophisticated hacks. More often, they walk through an unlocked door: a shared password, an old vendor account, or an employee login that never should have had that much access in the first place.
If you’re not sure where your business stands, that’s where we can help. At 2 Dog Digital, we help small businesses build practical, layered security that fits the way they actually work. Sometimes that means making better use of Microsoft 365. Sometimes it means adding additional protections. It always starts with understanding your environment before recommending solutions.
What to remember
- Verify every user, device, and request.
- Give people access only to what they need.
- Remove accounts and permissions that are no longer needed.
- Use the security tools you already own to their full potential.
- Review your environment regularly because your business changes, and your security should too.
If you’re wondering how close your business is to Zero Trust, let’s have a conversation. We’ll help you understand where you are today, identify the biggest risks, and recommend practical next steps that fit your business
FAQ
What is Zero Trust security?
Zero Trust is a cybersecurity strategy based on three principles: verify explicitly, use least privilege, and assume breach. Instead of automatically trusting users or devices because they're inside your network, every request is evaluated before access is granted.
Does Zero Trust only work for large companies?
No. Zero Trust scales to organizations of any size. Small businesses can implement many of the same security principles used by large enterprises, including multi-factor authentication (MFA), least privilege access, device management, and network segmentation. Many businesses already own some of the tools needed to get started.
What are the first steps to Zero Trust for a small business?
Start by auditing your user and vendor accounts, enabling MFA wherever it's available, and reviewing who has access to what. Those three steps can significantly reduce your risk and don't require new hardware or a major technology project.
Is MFA part of Zero Trust?
Yes. MFA is one of the most important identity controls in a Zero Trust strategy because it verifies that the person logging in is who they claim to be. While it doesn't eliminate every risk, it makes stolen passwords far less useful to an attacker.
Can Microsoft 365 help support a Zero Trust strategy?
Yes. Microsoft 365 Business Premium includes features such as Conditional Access, Microsoft Defender for Business, Intune, and Microsoft Entra ID that can support a Zero Trust strategy. Those tools are most effective when they're properly configured and combined with other security measures like endpoint protection, firewalls, and ongoing security management.
Do I need to buy new software to implement Zero Trust?
Not necessarily. Many businesses already have some of the tools they need. In many cases, the biggest improvements come from auditing accounts, enabling existing security features, tightening access permissions, and properly configuring the technology you already own. Additional security solutions may be recommended depending on your environment and risk profile.
Do small businesses in Raleigh and North Carolina need Zero Trust?
Absolutely. Cybercriminals don't target businesses based on geography or size. They target organizations with weak security controls. Whether your business is in Raleigh, Johnston County, or anywhere else in North Carolina, reducing unnecessary access, requiring MFA, and strengthening identity security can significantly reduce your risk.