Your network trusts everything that’s plugged into it.

Picture the laptop on the desk in reception. It is used to sign visitors in, it is a few updates behind, and one morning someone opens the wrong attachment on it. On most business networks, that laptop can now talk to the finance server, the file shares, the backups and the card terminals — because nothing on the network ever asked whether it should.

That is what a flat network is: a building where every door is unlocked because the front door is. It was built that way for good reasons. It is simple, everything works, and nobody has to file a ticket to print. But it means the size of any incident is decided by the weakest device you own.

Why small incidents become big ones

Attackers rarely land where they want to be. They land where they can — a phished laptop, a camera with a default password, a supplier’s remote-access account — and then they move. Security people call it lateral movement: from the first foothold to the systems that matter, one hop at a time.

On a flat network there are no hops. The foothold is already next to everything. It is why ransomware that starts on one machine so often ends on all of them, backups included.

Trust the request, not the wire

The idea behind Zero Trust is simple: being connected to your network proves nothing. Every request to a system should answer three questions before it gets through:

1. Who is asking? A named person, verified with more than a password.
2. From what? A device you manage, in good health, up to date.
3. For what? Only the systems their role needs, nothing more.

A traditional VPN does the opposite. It checks you once at the door and then puts you inside — on the same flat network as everything else. Replacing it with access that checks each application, each time, is often the single biggest step a business can take.

Separate by purpose

You don’t need to rebuild the network to take the trust out of it. You need to stop treating everything on it as one thing. Most businesses need five or six zones, drawn by what the devices are for:

• People — laptops and phones.
• Servers — the systems the business runs on.
• Payments — card terminals and whatever processes cards.
• Guests — visitors’ devices, which should reach the internet and nothing else.
• Things — printers, cameras, door controllers, building systems.
• Management — the consoles that run all of the above, reachable by very few.

Between zones, the rule is the same: nothing is allowed unless someone decided it should be. The printers don’t need to reach the finance server. The guests don’t need to reach anything of yours at all.

Ninety days, in three steps

This is a change you can make in stages, without a weekend of downtime.

Days 1–30: learn what actually talks to what. Before you block anything, watch. Your firewall and switches already see the traffic; a month of it shows which connections are real and which merely possible. The real list is always smaller than people fear.

Days 31–60: split out the riskiest first. Guests and things go first: they are the easiest to separate and the likeliest way in. Payments next, which also shrinks what your card-security obligations apply to.

Days 61–90: put sign-in in front of your applications. Internal systems move behind access that verifies the person and the device for every session. The always-on VPN can then be retired, or kept for the few who truly need it.

What good looks like

When the network no longer trusts the wiring, three things are true:

• A compromised laptop can reach what its user can reach — and nothing else.
• A visitor, a printer or a camera can’t see a single server.
• If someone asks “what can talk to the finance system?”, the answer fits on one page.

None of it makes the network harder to use. Done well, people notice nothing at all. The difference only shows on the bad day, when an incident that would have reached everything stops at the first device it found.