Zero Trust for the 50-Person Company: A Realistic Blueprint

By Stackvora Team · 2026-03-18 · 8 min read

"Zero trust" got a bad reputation from vendor marketing, but the underlying idea is simple: every access request is authenticated, authorized and encrypted, regardless of network location. For a 50-person company in 2026, it's cheaper than the VPN + castle-and-moat setup you probably run today.

The four building blocks

  1. Identity provider — one directory, MFA-enforced, with strong device signals.
  2. Device trust — you know which devices are managed and healthy.
  3. Application gateway — apps published through an identity-aware proxy, not exposed to the internet.
  4. Observability — sign-in logs, device logs, and app access logs in one place.

The stack that works for < 100 people

  • Identity — Entra ID (Microsoft 365 Business Premium) or Google Workspace + JumpCloud.
  • Device trust — Intune, Kandji, or JumpCloud MDM.
  • ZTNA gateway — Cloudflare Access, Twingate, or Tailscale ACLs. All three have real free/cheap tiers for small teams.
  • SIEM lite — Sumo Logic, Panther, or the built-in tenant logs shipped to a bucket + Grafana.

What to skip

  • SDP appliances. You don't need them at this size.
  • Microsegmentation. Below 500 endpoints the ROI is negative.
  • A dedicated SOC. Managed detection & response is cheaper and better.

Migration path from a legacy VPN

  1. Deploy the ZTNA client alongside the VPN — no cutover yet.
  2. Publish internal apps through the ZTNA gateway, one at a time.
  3. Move users to the ZTNA client group; leave the VPN for admin break-glass.
  4. Decommission the VPN once nothing has touched it in 30 days.

The 90-day plan

  • Month 1 — enforce MFA everywhere, roll out MDM to all endpoints.
  • Month 2 — publish internal apps through the ZTNA gateway, keep VPN for backup.
  • Month 3 — write and enforce a Conditional Access policy that requires compliant device + MFA + acceptable location.
Zero trust for a small company isn't a moonshot — it's a slightly better version of the SaaS-plus-MDM setup you're probably 60% of the way through already.

More blog posts · Knowledge base