Is Zero Trust just marketing?

The term is overused, but the underlying principles are real and testable. The test: if an attacker phishes one employee credential, can they reach production data? In a Zero Trust architecture with device trust and JIT access, the answer is no. In a VPN-and-shared-credentials architecture, the answer is yes. That is the difference the label points at.

How much does this cost?

SSO $6-15/user/month, MDM $5-10/user/month, identity-aware proxy $3-10/user/month, JIT access tool $10-30/user/month. All-in roughly $25-65/user/month for a 50-person company. Cheaper than one breach and dramatically cheaper than the enterprise contracts it unlocks.

We're 15 people — is this overkill?

SSO and MDM are not overkill at any size — they are cheaper and more effective than fighting the same fires later. Identity-aware proxy and JIT access can wait until you have 30+ people or your first serious enterprise deal, whichever comes first.

Zero Trust: Identity-Aware Proxies, Device Trust

Zero Trust replaces the assumption that internal traffic is trusted with continuous verification of every request.

Zero Trust Architecture: Beyond the Buzzword to Concrete Controls

Zero Trust is the security architecture principle that no network location, device, or identity is trusted by default — every access request is authenticated, authorized, and encrypted, regardless of whether it originates from inside or outside the corporate network. It replaces the traditional 'castle-and-moat' model (hard perimeter, soft interior) that fails the moment one credential is phished or one VPN concentrator is compromised. For a startup the concrete implementation is a small number of high-leverage controls, not a platform purchase.

The three pillars in practice

(1) Verify explicitly — every request is authenticated with strong identity (SSO with phishing-resistant MFA, ideally WebAuthn/passkeys). No shared credentials, no long-lived API keys where a short-lived token works. (2) Least privilege — access grants are just-in-time and just-enough. No standing admin. Production access requires a ticket or approval that logs who, what, when, why. (3) Assume breach — segment blast radius, log everything, alert on anomalies. Design as if one endpoint or one credential will be compromised, because they will.

Identity-aware proxy for internal apps

Replace VPN for internal web apps with an identity-aware proxy: Cloudflare Access, Google IAP, Tailscale Funnel, or open-source Pomerium. Each request to an internal app goes through the proxy, which checks the user's SSO identity, group membership, device posture, and issues a short-lived signed header. Benefits: no VPN client, works from any network, per-app authorization, complete audit log, revocation via SSO disable. Cost: usually $3-10/user/month. This one change eliminates the 'stolen VPN password → lateral movement' class of breach.

Device trust and posture

Access decisions should consider not just who but from what. MDM (Kandji, Jamf, Intune) enrolls corporate laptops, enforces disk encryption, screen lock, OS updates, and produces a device compliance signal. The identity-aware proxy consumes that signal — production access denied from a non-compliant or non-managed device. BYOD is harder; the honest answer for most startups is that BYOD does not get production access, only email and Slack. For contractors, ship them a managed device or route them through a virtualized workspace.

Just-in-time access for production

Standing production access is the single largest source of insider risk and blast radius. Replace it with just-in-time: engineer requests access via a Slack command or internal tool, states a reason (linked to incident ticket or change request), gets approved (self-approved for on-call, peer-approved otherwise), receives a time-boxed grant (30 minutes to 4 hours), and the grant is automatically revoked. Tools: sudo/ssh via Teleport or Boundary, cloud console via ConductorOne / Opal / Sym, database access via Bytebase. Complete audit log every time.

What to build first

Priority order for a startup: (1) SSO with WebAuthn/passkey MFA — foundation for everything else. (2) MDM on every laptop that touches production. (3) Identity-aware proxy in front of every internal admin panel. (4) Remove standing production access, move to just-in-time. (5) Segment production network so a compromised web tier cannot reach the database subnet directly. Everything else — microsegmentation, service mesh mTLS, continuous authorization — is optimization. Do not buy a 'Zero Trust Platform'; buy focused tools that solve each of these controls well.

Frequently asked questions

Is Zero Trust just marketing?: The term is overused, but the underlying principles are real and testable. The test: if an attacker phishes one employee credential, can they reach production data? In a Zero Trust architecture with device trust and JIT access, the answer is no. In a VPN-and-shared-credentials architecture, the answer is yes. That is the difference the label points at.
How much does this cost?: SSO $6-15/user/month, MDM $5-10/user/month, identity-aware proxy $3-10/user/month, JIT access tool $10-30/user/month. All-in roughly $25-65/user/month for a 50-person company. Cheaper than one breach and dramatically cheaper than the enterprise contracts it unlocks.
We're 15 people — is this overkill?: SSO and MDM are not overkill at any size — they are cheaper and more effective than fighting the same fires later. Identity-aware proxy and JIT access can wait until you have 30+ people or your first serious enterprise deal, whichever comes first.

Related fundraising guides (40)

Investor directory · Fundraising library · Articles A–Z · Company funding database