Zero trust security that checks every sign-in without slowing anyone down.

What zero trust means for a growing business

The old model trusted anything inside the office network and guarded the edge with a firewall and a VPN. That worked when everyone sat in one building and every app lived on a server down the hall. Today your files live in Microsoft 365 or Google Workspace, your team signs in from home and client sites, and an attacker holding one stolen password can look exactly like an employee.

Zero trust replaces location with evidence. Three principles do most of the work.

• Verify explicitly. Every sign-in is checked using identity, MFA, device health and context such as location and sign-in risk, through conditional access rules.
• Use least privilege. People and apps get only the access their role needs, and admin rights are rare and time-limited.
• Assume breach. Design so that one compromised laptop or account cannot reach everything, and watch for signs that something is already wrong.

A practical sequence, starting with identity

You rarely need to buy anything new to start. Most of the work is configuration in platforms you already pay for. The order matters because each step makes the next one safer and easier to roll out.

1. Identity

   MFA on every account, older sign-in methods that skip MFA blocked, admin accounts separated from daily ones and stale accounts removed. This closes one of the most common ways in: a stolen or guessed password.

2. Device health

   Company laptops and phones enrolled in management, encrypted, patched and running endpoint protection. Unmanaged personal devices get browser-only access, so company files don't land on them.

3. Least privilege

   Role-based groups for shared drives, SharePoint sites and business apps, local admin rights removed from staff laptops, and access reviewed on a schedule.

4. Segmentation

   Staff, guests, printers, cameras, servers and lab or production equipment on separate networks, with remote access granted to specific apps rather than the whole network.

5. Continuous verification

   Risky sign-ins, impossible travel and repeated MFA prompts reviewed around the clock, with session lengths that suit each type of access.

Segmentation is where identity work meets the network, so we plan it together with our network and server consulting work. That way firewall rules and access policies describe the same intent.

Where do you stand? A zero trust maturity table

Use this to place yourself honestly. It's normal to sit in different columns for different rows. Aim for Solid everywhere before chasing Strong anywhere.

If most of your rows sit in the first column, that is a normal place to start. It simply means the first phase of work will make the biggest difference.

MFA options compared: from text codes to passkeys

Any MFA beats a password alone, but the methods are not equal. The question that matters is whether a method is phishing-resistant: whether it still protects you if someone enters their details on a convincing fake sign-in page.

Passkeys and security keys resist phishing because the credential is tied to the real website's address. A fake page on a different domain simply can't use it, however convincing it looks. Microsoft 365 and Google Workspace both support them, so moving to phishing-resistant MFA is mostly a rollout and recovery plan rather than new software.

Staff should know what to do when it happens: deny the prompt, report it and change the password. Our phishing awareness training covers fake sign-in pages and unexpected prompts alongside the usual email red flags.

Admin accounts and privileged access

Admin accounts can change every setting, read every mailbox and switch off every alert. They deserve the strictest rules and the shortest list of people.

• Separate admin accounts for IT staff, with no mailbox and no everyday browsing
• As few global admins as possible; Microsoft recommends fewer than five
• Narrower roles, such as user or helpdesk administrator, for routine tasks
• Phishing-resistant MFA on every admin account, with no exceptions
• Time-limited admin elevation where your licensing supports it
• Two emergency access accounts with long passwords and security keys, stored securely and alerted on any use
• Local admin rights removed from staff laptops, with a quick way to request approved software
• Service accounts listed, owned by a named person and blocked from interactive sign-in
• Shared passwords moved into a business password manager

Connected apps are access too

Every app a user connects to their work account, such as a scheduling tool, an e-signature add-in or an AI assistant, receives its own permissions to mail and files. Limit which apps people can approve on their own, require an admin review for anything that asks to read mail or files, and remove connections nobody uses. Microsoft 365 and Google Workspace both have controls for this.

Hold your IT provider to the same standard, including us. Outside administrators should use named accounts with MFA, and their access should be documented and limited to what the work requires. We work with documented, least-privilege access agreed with you.

Joiners, movers and leavers: where access quietly leaks

Disabling a departed employee's account is the easy part. Access also leaks through places a basic checklist misses: an MFA method registered on a personal phone, an app the person connected to their work account, a vendor portal that doesn't use company sign-in, or a shared password they still know.

• Leavers. Sign the account out of every session, remove its MFA methods and connected apps, and check for forwarding rules before converting the mailbox. List outside portals such as banking, payroll, shipping and supplier sites, because company sign-in rarely covers them.
• Movers. People who change roles keep collecting access unless someone removes the old permissions. Over a few years, a long-serving employee can end up able to reach far more than any one job needs.
• Joiners. New hires get access by role from day one, not a copy of whoever had the seat before them. Copying an existing account is how excess access spreads.
• Contractors and vendors. Give temporary access an end date when you grant it, so it expires on its own instead of waiting to be remembered.

Our managed IT onboarding and offboarding workflows handle the routine steps the same day. The identity work adds the parts that are easy to forget, and a quarterly access review catches anything that slipped through.

Hybrid work across San Diego County

Your perimeter now includes a home office in Chula Vista, a client site in Downtown San Diego, a lab bench in Sorrento Valley and a hotel lobby during a conference. Good zero trust security in San Diego checks the person and the device, not the location, and a few local situations deserve specific design choices.

• Cross-border work. Teams that cross through Otay Mesa or San Ysidro for manufacturing, logistics or family will sign in from Mexico. A blanket block on foreign sign-ins locks them out, so use named exceptions and require a compliant device instead.
• Personal devices. Contractors and part-time staff can work in the browser on unmanaged devices with downloads and syncing restricted, while company laptops get full access.
• Shared workstations. Dental front desks, lab instrument PCs and warehouse terminals often share a single login. HIPAA's Security Rule requires unique user identification for systems with patient data, so individual sign-ins come first, and devices that can't support MFA get isolated on their own network.
• Public and client networks. Attorneys at the courthouse, sales staff at a trade show and engineers at a customer site all work on networks you don't control. Access that depends on device health and MFA, rather than on being in the office, keeps that work safe.

Industry shapes the details. A dental practice needs fast sign-ins at a shared front desk, while a software company may need engineers to reach cloud consoles from anywhere. Policies should follow how each team actually works.

How a zero trust rollout works, and what drives cost

Zero trust breaks things when it is switched on all at once. We roll it out the way you would change any critical system: measure first, test with a pilot group, then expand in stages.

• Audit. MFA coverage, admin role holders, use of older sign-in methods, stale and shared accounts, device inventory and external sharing.
• Report-only first. New access policies run in report-only mode, so we can see who would have been blocked before anyone actually is.
• Pilot, then departments. IT and a few volunteers go first, then one team at a time, with clear notice and help on hand for MFA enrollment.
• Ongoing. Sign-in monitoring by our SOC, regular access reviews and policy tuning, reviewed with you at each quarterly business review.

What your team will notice

If you are weighing zero trust security in San Diego, the practical question is what changes for staff day to day. Usually less than people expect:

• A one-time MFA enrollment, with help on hand, and a new way to approve sign-ins.
• Fewer password prompts on managed company laptops, not more.
• Browser-only access when working from a personal device.
• A quick request process instead of installing software themselves.

Identity-first access is part of every environment we manage and sits inside our flat, per-user monthly pricing, so headcount is the main driver. Scope also depends on your license tier, because some controls, such as conditional access in Microsoft 365 or context-aware access in Google Workspace, need specific plans. Other factors are the number of devices to enroll, whether you need security keys and how much older technology needs workarounds. Larger network changes, such as new firewalls for segmentation, are scoped as separate projects.

What not to do

• Don't switch everything on at once. Policies that skip report-only mode and a pilot group are how an executive gets locked out on a Monday morning.
• Don't rely on blocking countries. Attackers can route sign-ins through local infrastructure. Location is a useful signal, not a control on its own.
• Don't exempt executives. The people who find MFA inconvenient are often the accounts attackers want most.
• Don't leave older sign-in methods open. Some printers, scanners and business apps still use protocols that can't do MFA. Find them, replace or isolate them, then block the rest.
• Don't stop at text-message codes. They are a starting point, not the end state for anyone with admin or payment access.
• Don't treat it as a project with an end date. People join, move and leave every month. Access reviews and monitoring keep the model accurate.