The traditional security model has relied for decades on the logic of protecting a clear boundary between what was internal and trustworthy and what was external and represented a risk. 

This boundary, however, has ceased to exist. Employees access systems from home, workloads are distributed across data centers, public clouds, and SaaS applications, and third-party partners connect to corporate environments through interfaces that were rarely designed for the current volume of external traffic.

The concept of Zero Trust emerged as a response to this scenario. The term went from being discussed at conferences to a requirement cited in audits and executive reports. According to the Zero Trust statistics report published by the Order in 2026 , 82% of organizations consider the model essential to their security strategy, although only 17% have managed to fully implement it.

The gap between recognizing the importance of Zero Trust and actually implementing it is often larger in companies that use legacy ERP systems, undocumented integrations, and servers that cannot simply be shut down for reconfiguration.

In this article, you will understand what changes in the security model when Zero Trust is adopted, what its fundamental pillars are, and where a company with a hybrid environment and legacy systems can begin without interrupting operations.

What changes when the perimeter ceases to be the line of defense?

For a long time, corporate security was organized around the idea that there was a trusted internal network, protected by a firewall, and an external network that needed to be filtered. Those inside had broad access. Those outside needed to be authenticated only once to cross the perimeter. This logic worked as long as the operation was concentrated in a single physical address, with fixed workstations and local servers.

With the expansion of remote work, the adoption of public cloud, and integration with dozens of SaaS services, the perimeter has lost practical meaning. Legitimate users can access critical systems from anywhere, and an intruder who obtains valid credentials can move around the environment with the same freedom as any other employee. 

Not coincidentally, the Microsoft Digital Defense Report 2025 recorded a 32% increase in identity-based attacks in the first half of 2025, with Microsoft blocking approximately 7.000 password attack attempts per second on its Entra platform.

Zero Trust architecture starts from a different premise. No request is trusted by origin, even if it comes from within the network. Every access to a resource needs to be authenticated, authorized, and continuously re-evaluated based on identity, device context, data sensitivity, and observed behavior. This principle was formalized by NIST in special publication 800-207 and has since guided the main security guidelines adopted by regulatory bodies and large corporations.

The five pillars of a Zero Trust architecture

Zero Trust is not a product you buy off the top of your head. It's an architecture organized around five interdependent domains, each with its own controls and maturity that evolves at different paces.

Identity

It is the core of the entire Zero Trust architecture. Every user, application, service, or device needs to have a unique, centrally managed identity with strong authentication. Phishing-resistant multi-factor authentication, based on cryptographic keys or biometrics, has become the new standard. According to Microsoft, this type of MFA blocks more than 99% of identity-based attacks, even when the credential has already been compromised.

Devices

Every device that connects to a corporate resource needs to be known, evaluated, and have its security posture validated in real time. This involves centralized management, operating system update verification, the presence of a protection agent, and compliance with minimum policies before access is granted.

speech

Traffic is segmented into micro-perimeters, so that a compromised credential in one segment does not grant lateral access to others. Traditional VPNs, which once authenticated release large portions of the internal network, are beginning to be replaced by conditional access solutions such as ZTNA (Zero Trust Network Access) . According to the Zscaler ThreatLabz 2025 VPN Risk Report , 65% of organizations plan to replace their VPNs in the next year.

Applications and workloads

Each application, whether hosted in its own data center, in colocation, or in the public cloud, must have explicit access policies, encryption in transit and at rest, and behavior monitoring. Traffic between internal services will be authenticated in the same way as external traffic.

Data

The final layer. Data classification, granular access control, leak prevention, and policy-based encryption become active tools, not just compliance records. It is at this layer that Zero Trust meets the discussion about privacy and protection against exfiltration.

Two cross-cutting capabilities operate across these five domains: visibility and continuous analysis , which allow for understanding what is happening in the environment in real time, and automation and orchestration , which translate policy decisions into consistent and scalable actions.

Why legacy environments require a different approach.

The practical difficulty of adopting Zero Trust rarely lies in the concept itself. It lies in the reality of the installed infrastructure. ERPs contracted more than a decade ago, internal applications running on unsupported operating systems, integrations that depend on service accounts with fixed passwords in configuration files, and servers that require a specific maintenance window for any change are concrete obstacles that appear at the beginning of the journey.

The Ordr report points out that the proliferation of tools is the main obstacle to implementation, even ahead of budgetary constraints. 78% of organizations manage access policies in more than two different systems, which generates inconsistent application, rework, and delays in incident response. In legacy environments, this scenario is aggravated because each legacy system usually has its own authentication and authorization model, incompatible with modern standards such as SAML or OIDC.

The good news is that the journey doesn't require replacing everything at once. Zero Trust is implemented in waves, starting with the points of greatest risk and greatest return. Legacy systems can be encapsulated by proxy layers that apply modern control over communication, without requiring changes to the original software. This approach, known as brownfield , is the most common in medium and large-sized Brazilian companies.

Where to start with Zero Trust in practice: a sequence applicable to real-world transactions.

There are different paths to begin adopting Zero Trust in practice. The sequence below prioritizes quick return over risk, minimizes operational disruption, and is compatible with environments that combine on-premise data centers, colocation, public cloud, and SaaS.

1. Discovery and classification

Before any control measures are implemented, mapping is essential. What applications exist, who accesses them, what data they store, what integrations they consume, and which service accounts are active? This inventory often reveals forgotten systems, inherited administrative access, and connections to third parties that no one can explain. Without this survey, any applied policy will be incomplete. 

Our article on the most common security mistakes that put companies at risk of attacks details many of the blind spots identified at this stage.

2. Identity Foundation

Consolidate identity across a single provider, enable phishing-resistant multi-factor authentication for all privileged access, and eliminate local accounts that duplicate corporate identities. This is the change that generates the greatest risk reduction in the shortest time and sustains all subsequent steps.

3. Segmentation and microsegmentation

Divide the network into zones with specific policies for each. Critical servers are located in isolated segments that require strong authentication for access, databases only receive connections from authorized applications, and development environments do not see production environments. In modern data centers and colocation environments, this segmentation can be applied programmatically, without requiring physical reconfiguration.

4. Gradual replacement of traditional remote access.

Migrate from traditional VPN to ZTNA for the most critical use cases, starting with third-party and administrator access. The VPN can continue to operate for specific scenarios during the transition, but it will no longer be the default gateway.

5. Application and data control

Apply application-level access policies and classify sensitive data. At this stage, Zero Trust intersects with the discussion on the LGPD (Brazilian General Data Protection Law) and the protection of regulated information, becoming an active instrument for compliance, not just defense.

6. Automated monitoring and response

Collecting telemetry from all decision points, correlating events, and applying automated responses to behavioral deviations. This is what transforms Zero Trust from a static policy into a living system, capable of adjusting to risk in real time.

The most common mistakes in the Zero Trust adoption journey.

Companies that begin implementation without a clear strategy end up repeating certain patterns that delay return on investment and compromise the effectiveness of the model.

The first mistake is treating Zero Trust as an isolated technology project , buying a tool and expecting it to solve the problem. The model requires process review, redefining responsibilities, and involving business areas, not just IT and security.

The second is to start with the most complex layer . Companies that begin with advanced micro-segmentation before consolidating identity and MFA build controls on a fragile foundation. A compromised credential remains the most exploited entry vector, and no degree of segmentation compensates for a leaked password without a phishing-resistant second factor.

The third is ignoring the operational cost of a more granular architecture. More policies mean more telemetry, more events to investigate, and more decisions to orchestrate. Without a support plan, the environment quickly generates alert fatigue, and policies become more flexible to keep operations running, negating the benefit of the model.

The fourth is underestimating internal resistance . According to StrongDM's Zero Trust state survey , 22% of organizations cited resistance from internal teams as a significant barrier. Employees accustomed to broad access tend to react negatively to stricter controls, and successful adoption depends on clear communication about the rationale, benefits, and ongoing support.

Frequently asked questions about Zero Trust

Many questions arise when IT managers begin mapping out the Zero Trust journey in their companies. The questions below frequently come up in conversations with clients seeking to understand where to start, how long the process takes, and how to justify the decision to management. The answers have been organized to support both technical teams and leadership, and can serve as an initial reference before a more in-depth analysis of the environment.

Does Zero Trust replace firewalls and antivirus software?

No. Zero Trust is an architecture that reorganizes how identity, devices, networks, applications, and data are protected. Firewalls, EDR, and other security tools continue to exist, but they operate within a logic of continuous verification, not as the sole line of defense in a perimeter. Implementation often reveals that many tools already exist in the environment but are underutilized or inconsistently configured.

Do medium-sized companies need to adopt Zero Trust, or is the model exclusive to large corporations?

Medium-sized companies are among the preferred targets of attacks today, precisely because they combine valuable assets with a lower level of security maturity compared to large corporations. Zero Trust is scalable, and the starting point can be much leaner: identity consolidation, phishing-resistant MFA, and basic segmentation already deliver significant gains without requiring an investment comparable to that of a large company.

How long does it take to implement Zero Trust?

There is no standardized timeframe. The initial layers, such as identity consolidation and MFA, can be implemented in a few months. A mature Zero Trust architecture, with continuous monitoring, micro-segmentation, and granular control over data, is usually the result of a two- to four-year journey. The important thing is to understand that the model delivers value at each stage, without depending on total completion to begin reducing risk.

Does Zero Trust work in environments with many legacy systems?

Yes. The correct approach is to encapsulate legacy systems within layers of modern control, applying authentication, authorization, and monitoring to communication with these systems, without requiring changes to the original software. Application proxies, identity gateways, and network microsegmentation allow legacy applications to coexist with a Zero Trust architecture, protected by controls compatible with current maturity levels.

What is the difference between Zero Trust and ZTNA?

Zero Trust is the complete architecture encompassing identity, devices, network, applications, and data. ZTNA (Zero Trust Network Access) is a specific technology within this architecture, focused on replacing traditional VPNs with conditional access to applications. Adopting ZTNA is an important step on the journey, but it is not equivalent to fully implementing Zero Trust.

Structure your Zero Trust journey with those who understand the Brazilian environment.

With 22 years of experience, Ayko works in the implementation of security, infrastructure, and continuity architectures for companies that need to evolve without interrupting operations. Our approach starts with a careful analysis of the environment, respecting the reality of the installed infrastructure and prioritizing the points of greatest return.

If your company is evaluating where to begin its Zero Trust journey or needs to consolidate controls in a hybrid environment, contact our experts and discover how to transform security into a solid foundation for growth.