Zero-Trust for Regulated SMBs Without the Enterprise Price Tag

No. Zero-trust is a principle — never trust, always verify — not a product, and a regulated SMB can reach roughly 80% of the benefit with identity tools it likely already owns. There's a scale where a dedicated ZTNA platform earns its cost, but most regulated SMBs are years away from it.

Consolidate identity. That's the whole game and most of the value: SSO fronting every SaaS tool that supports it, MFA on 100% of human accounts, phishing-resistant MFA (FIDO2 or passkeys) on every admin, and named accounts replacing the shared logins so offboarding is a single revocation action.

A VPN is a moat, and the moat model assumes the attacker is outside. But the most reliable path in is a phished employee credential, and once it's inside a flat network the attacker reaches everything. Zero-trust replaces 'connect to the VPN and you're trusted' with per-application access that verifies identity and device every session.

Identity, then device, then network, then continuous verification. The order matters more than the tooling because each phase makes the next meaningful — buying the microsegmentation product before consolidating identity is spending on phase three while phase one is still open.

Far less than the six-figure platform pitch. The four phases get you a genuine posture using an identity provider you already have, a modest MDM, cloud-native segmentation (VPC boundaries, security groups), and an access proxy like Cloudflare Access or Tailscale that's often cheaper than the VPN concentrator it replaces.

Not enterprise zero-trust — the bar is that a phished credential on an unmanaged device can't reach the PHI store. That's reachable this quarter with tools you mostly already own, and it's the bar that actually keeps you out of a breach notification.