Zero Trust On A Beer Budget, Redux: Minimum Viable Zero Trust
The useful management takeaway is not whether Zero Trust is conceptually sound, but whether your organization can turn it into a disciplined, affordable sequence of decisions. For many CIOs, the failure mode has been treating Zero Trust as a destination program with vague maturity ambitions, rather than a portfolio of targeted controls tied to specific business risks, user groups, and access scenarios.
Minimum viable thinking matters because it shifts the conversation from architecture theater to investment governance. Leaders should ask which existing identity, endpoint, network, and logging capabilities can be integrated before approving more platform spend. The real constraint is often not missing tools; it is fragmented ownership across infrastructure, security, workplace, and application teams, with no single authority to define policy, integration priorities, and measurable outcomes.
This creates an operating-model question as much as a security one. A pragmatic Zero Trust approach needs clear decision rights: who prioritizes use cases, who accepts residual risk, and who funds integration work that may not fit neatly into one team’s budget. Without that, organizations buy point solutions, declare progress, and stall after initial remote-access improvements.
Practical next questions for leadership include:
- Which three access journeys create the highest business and security exposure today?
- What controls already owned can be orchestrated to reduce that exposure within two quarters?
- How will success be measured: reduced privileged access, faster offboarding, fewer exceptions, improved auditability, or lower vendor overlap?
The trade-off is clear: incremental progress may look less transformative, but it is more governable, more fundable, and more likely to survive budget pressure.
If you’ve studied the reference architectures, read the BeyondCorp whitepapers, poured over strategies and fan charts, or tried to plot your position in any of the (many) Zero Trust maturity models and found yourself inspired by the concepts but puzzled by the process, you’re not alone.
If the sheer number of Zero Trust something-or-others available from cybersecurity vendors filled you with skepticism and made you wonder whether the whole endeavor was just “expense in depth” with a catchier title, you’re in good company.
If the wave of 2.0 announcements and “innovations” seemed unconnected to widespread (and successful) implementations of 1.0, well…
Does that mean that Zero Trust was nothing more than a flash in the pan all along? No. But there’s no doubt that Zero Trust fatigue is real or that perfect has become the enemy of good for many organizations.
Keeping up with the Joneses
The highest profile, most sophisticated Zero Trust initiatives had something in common: they were undertaken by organizations whose technical and financial resources were effectively infinite, especially relative to the average enterprise. These programs lent credence to Zero Trust as a viable approach to security strategy. They also created a perception that adoption would necessarily involve sweeping changes and a lot of new technology (accompanied by the usual costs). These conditions may not have directly disincentivized Zero Trust, but they raised the stakes in ways that left many organizations perpetually admiring the problem instead of taking steady, incremental action.
Fits and starts
The advent of Zero Trust Network Access (ZTNA)—or, in more explicit terms, remotely-hosted remote access with multi-factor user authentication and device posture checking—was the first genuine step on most organizations’ Zero Trust journeys. It was also where a lot of initiatives stalled. To be clear: it was an important step; it was not, however, a precursor to an obvious next step.
There are still internal and external pressures to “improve Zero Trust maturity” but that is very much a “what” and not a “how”. Vendors and enterprises alike seemed to treat it like the titular character in the Beetlejuice movies: if they repeated the name enough times (and tacked on enough new adjectives for good measure), Zero Trust would somehow magically appear.
Making Zero Trust real without breaking the bank
So what should organizations do? A lifetime ago (in technology terms, at least), my predecessor’s predecessor (we’re careful about name-checking former analysts around here, lest their specters reappear like the aforementioned Beetlejuice) wrote about an undertaking he called Zero Trust On A Beer Budget. It was an exercise in making reasonable investments that would help build security capabilities without outlandish budgets or the sorts of big, risky swings that doom projects to failure during implementation or subsequent operation.
It’s time to put a finer point on that idea. Rather than leaning on abstract reference architectures and high-level maturity models for guidance, it’s time to start thinking more about how to implement Zero Trust with the least amount of effort while still satisfying its tenets. We’re christening this pivot “Minimum Viable Zero Trust (MVZT).”
We’re borrowing a bit from the idea of a Minimum Viable Product (MVP), not because Zero Trust is a product, but because MVPs are helpful for learning by building and Zero Trust is a way of building. MVPs are also deliberately less resource intensive than massive, cross-functional efforts. Lastly, MVPs help establish guideposts on the path of what to build next. To be clear: I’m not suggesting that you should “roll your own” solutions, but one of the greatest myths about Zero Trust is that implementing its principles requires the procurement of new technology.
MVZT is about leveraging what you have and overcoming the very real—and sometimes very difficult—systems integration challenges so you can make the most out of your current and future security investments.
Join me in Washington, D.C. on November 9th and 10th at Forrester’s Security & Risk Forum for a deep-dive session introducing Minimum Viable Zero Trust, where I’ll talk about what the journey really entails, how to get started using tools you already have, and some elbow grease.
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.