How to plan phased Zero Trust rollout for hybrid cloud with legacy on-prem apps?

[EleanorGH]

I'm a network security architect at a mid-sized financial services firm, and we're beginning the multi-year migration from our traditional perimeter-based security model to a Zero Trust Architecture, driven by our shift to hybrid cloud and a rise in sophisticated phishing attacks. The conceptual framework is clear, but the practical implementation is daunting, especially around segmenting our legacy on-premise applications and establishing continuous verification without crippling user experience. For other teams further along this path, what was your phased rollout strategy, and which foundational components did you tackle first? How did you gain buy-in from business units resistant to the added friction, and what specific tools or platforms did you find most effective for policy enforcement and micro-segmentation across hybrid environments?