Playbook
Our perimeter security is failing and we need a real Zero Trust strategy, not just multi-factor sign-in
The CISO has been told "we have Zero Trust" because multi-factor sign-in is on. The auditor is asking deeper questions: are devices checked for compliance, is access conditional on context, is the network segmented properly, is data classified. The current setup has gaps in every area and there's no joined-up programme.
Trigger — Audit questions on Zero Trust depth; insurer asking about architectural maturity.
Good outcome — A Zero Trust plan is laid out across identity, device, network, and data, with named owners for each pillar and a clear sequence. The customer can show the auditor and the insurer where they are and where they are heading.