A compromised Microsoft 365 account can give an attacker far more than access to one inbox. It may expose finance correspondence, customer records, password reset emails, shared files and supplier payment details. Zero trust for SMEs is designed to limit that chain reaction by checking every access request rather than assuming that a user, device or location is safe.
For smaller organisations, this is not about buying an expensive security platform or making people jump through unnecessary hoops. It is a practical security model: give people access only to what they need, verify that access continuously, and contain the impact when something goes wrong.
What zero trust means for an SME
Traditional networks were built around a trusted internal environment. If someone was in the office, connected to the corporate network and logged in with a password, many systems treated them as trustworthy by default. That made more sense when applications and files sat in one building and most work happened at fixed desks.
That boundary has disappeared. Staff work from home, use cloud applications, access data on mobile devices and collaborate with external suppliers. Attackers know that a stolen password, a convincing phishing email or an unmanaged laptop can provide a route into a business without ever needing to breach its office network.
Zero trust replaces assumed trust with explicit verification. Each request is assessed using context such as the user identity, multi-factor authentication status, device health, location, sensitivity of the application and the type of data being accessed. Access may be allowed, blocked or challenged for further verification.
The principle is straightforward: never trust access simply because it came from inside the network, and always verify it against the level of risk.
Why zero trust for SMEs is a business issue
SMEs are often targeted because attackers expect fewer security controls, stretched internal teams and inconsistent processes. A criminal does not need to take down a national organisation to make money. Diverting one supplier payment, encrypting a shared drive or stealing personal data can be enough to cause serious disruption.
The operational impact extends beyond the immediate incident. Leaders may need to pause work, communicate with customers, recover systems, investigate what happened and meet reporting obligations. For organisations handling personal data, the Information Commissioner’s Office may also need to be considered where a breach creates a risk to individuals’ rights and freedoms.
A zero trust approach helps reduce the blast radius. If an attacker gains a password, they should not automatically gain access to every shared folder, admin portal or business system. If a device is no longer encrypted, patched or protected, it should not be treated as suitable for sensitive work. This is a more realistic way to manage risk than relying on a firewall as the primary line of defence.
The controls that make the biggest difference
Zero trust is not a single product. It is a set of connected controls, applied in a sensible order. The right starting point depends on your current systems, risk profile and available resources, but most SMEs should focus on the following foundations.
Strengthen identity first
Identity is now the main security perimeter. Every user account, administrator account, shared mailbox, service account and external guest account needs to be known, owned and appropriately protected.
Multi-factor authentication should be in place for all users, particularly for Microsoft 365, remote access, finance systems and administrator accounts. It is worth avoiding weak methods where possible. App-based approval, number matching, passkeys and hardware security keys can offer better protection than text messages alone, depending on the system and user group.
Access should also follow least privilege. A member of staff who only needs to submit invoices should not have administrator rights or unrestricted access to payroll records. Privileged access needs extra protection, separate accounts where appropriate and regular review. This may feel restrictive at first, but it prevents convenience from becoming an unmanaged security risk.
Treat device health as part of access
A legitimate user on an unprotected device is still a risk. Laptops and mobiles used for business should have disk encryption, supported operating systems, current security updates, endpoint protection and screen locking in place. Where devices are centrally managed, policies can verify this automatically before granting access to company resources.
For a small business, that does not mean personal devices must be banned in every case. Bring-your-own-device arrangements can work, but they need clear boundaries. Access may be limited to web-based applications, sensitive downloads may be restricted, and business data should be kept within managed applications rather than copied into personal storage.
The trade-off is usability. A tightly controlled device policy is easier to enforce on company-owned equipment than on personal phones and laptops. The objective is not to create friction for its own sake. It is to match access to the sensitivity of the data and the confidence you have in the device.
Segment access to applications and data
Many businesses still provide broad network access through a virtual private network. Once connected, users may be able to reach systems that have nothing to do with their role. Zero trust moves towards application-level access, so staff connect to the specific services they need rather than the entire network.
The same principle applies to cloud storage. Shared folders should have named owners, clear access groups and periodic reviews. Avoid relying on old sharing links, generic accounts or permissions that have accumulated over years. Finance, HR, leadership and operational data should not all sit in one broadly accessible area simply because it is convenient.
For organisations with on-premises servers, segmentation can also separate core systems, guest Wi-Fi, CCTV, operational technology and administration. This makes lateral movement harder if one area is compromised.
Monitor what matters and respond quickly
Verification is only useful if unusual activity can be seen and acted on. Review sign-in alerts, failed login patterns, unexpected mailbox rules, new administrator accounts and large file downloads. Ensure security notifications reach a person or service that can investigate them promptly.
A managed detection and response service may be appropriate where an SME does not have the capacity to monitor alerts outside office hours. However, tools alone are not the answer. Your incident response process should define who can disable an account, isolate a device, contact suppliers and make operational decisions during an incident.
A sensible implementation plan
Trying to redesign every system at once can delay progress. A phased approach gives the business early protection while allowing time to resolve legacy issues.
- Map identities and critical systems. Establish who has access to Microsoft 365, finance platforms, file storage, remote access and administrator tools. Remove dormant accounts and identify shared credentials that need replacing.
- Enforce multi-factor authentication. Begin with administrator accounts and high-risk services, then extend coverage to every user. Put a process in place for lost phones, new starters and access recovery.
- Standardise device management. Define a baseline for company devices and decide what access personal devices can receive. Record exceptions rather than letting them become invisible.
- Review permissions and sharing. Prioritise sensitive folders, financial applications and systems containing personal data. Assign ownership so access reviews are not left solely to IT.
- Improve logging and response. Test how quickly you can identify and contain a compromised account. A tabletop exercise often exposes gaps before a real incident does.
This sequence is deliberately practical. It will not deliver every zero trust capability immediately, but it tackles the routes attackers use most often.
Common mistakes to avoid
The first mistake is treating zero trust as a procurement exercise. A new licence will not fix excessive permissions, poor offboarding or staff who use shared passwords because the process is difficult. Technology must support clear operational rules.
The second is applying the same level of control to every activity. Requiring repeated authentication for low-risk tasks can lead people to work around security. Conditional access should be proportionate: stronger checks for privileged actions, sensitive data or unfamiliar devices, with less friction for routine work on compliant equipment.
Finally, do not overlook third parties. Accountants, outsourced HR providers, software support teams and contractors may need access to systems or data. Give them named, time-limited accounts wherever possible, review their access regularly and remove it as soon as the work ends.
Making security part of everyday operations
Zero trust works best when it is treated as part of how the organisation operates, not as a separate IT project. Joiner, mover and leaver processes should trigger access changes promptly. Procurement should consider whether new software supports multi-factor authentication and clear access controls. Managers should understand who owns sensitive data and why permissions are granted.
For SMEs across Cambridge, Cambridgeshire and the wider South East, the challenge is usually not a lack of security products. It is making sound decisions consistently while keeping the organisation productive. A proactive IT partner can help translate zero trust principles into policies, technical controls and practical support that fit the way your teams actually work.
The most useful first question is not whether your business has achieved zero trust. It is this: if one employee account were compromised this afternoon, how much could an attacker reach? Every sensible improvement should make that answer smaller.
