12-25-2025, 08:17 AM
I'm a security architect at a mid-sized financial services firm, and we're beginning a multi-year project to implement a Zero Trust Architecture, moving away from our traditional perimeter-based model. The scope is overwhelming, covering identity, devices, networks, and applications. For teams who have undertaken this transition, what was your practical starting point and sequencing for the different pillars? How did you handle legacy applications that can't easily be refactored for micro-segmentation or continuous authentication, and what were the biggest cultural and operational hurdles with users and other IT departments? I'm also evaluating vendors for ZTA components versus building in-house, particularly around policy enforcement and analytics.