Zero-trust is not a product – it’s a philosophy

There’s an implicit contract when we get on a plane. Identities are verified, bags are checked and potentially dangerous cargo is kept out of the hold. It’s to verify that we are who we say we are, and that everyone is kept safe.

This is the world of zero-trust. Every identity and action is verified to minimise the risk of an incident.

Jeremy Nees, the CPO at Virtual IT Group, helps mid-market companies assess their risk and adopt a zero-trust architecture.

“The world is shifting fast. AI enables attackers to find and exploit flaws in record time. Zero‑trust isn’t a checkbox or a product. It’s an approach that aligns with business risk, identity, and remote operations. It requires adequate resources, clear understanding and a security‑as‑enabler mindset to protect businesses.”

There are three key steps to enabling zero-trust. Jeremy says businesses must start with an environmental audit. This is followed by a risk assessment. The final piece of the puzzle is to acquire tools and capability to mitigate those risks with a focus on what will bring a measurable benefit and not the latest threat that hits the headlines.

“Find a pragmatic place to start and go from there,” Jeremy advises.

One potential blind spot for many organisations is the exponential growth in the number of non-human identities. Unlike traditional non-human identities that connected machines and services in a one-to-one way, AI agents mesh with each other similarly to how people work together.

This makes having a robust identity management system that knows who every identity is, what they can access, and how they interact is vital. Jeremy says the good news is that if you have a viable zero-trust architecture in place this becomes a manageable challenge.

An effective zero-trust strategy and architecture starts by knowing your environment, assessing the risks and putting processes and systems in place to mitigate those risks. Virtual IT Group works closely with customers through every step of that process to ensure they are as well protected from threats as possible.