Zero-Trust Sounds Cool Until You Have To Explain It To Your Boss
Look, I love zero-trust. I really do. No VPN, per-user access, mTLS everywhere. On paper it's perfect.
In real life? I spent 3 weeks setting up mTLS + identity-aware proxy for our internal dashboards. Technically flawless. Then my PM asked me: "So do we still need the VPN?" And I realized — if I can't explain it in 30 seconds, nobody's gonna use it.
How I finally explained it
I stopped saying "zero-trust architecture" and started saying this:
"Old way: once you're inside the office WiFi, you can touch everything. New way: every single app checks who you are, every single time. Like TSA, but for our dashboards."
That clicked. Everyone got it.
What I actually kept in production
Not the full 50-page vendor setup. Just this:
1. Cloudflare Access in front of everything internal. No public IP, login with Google Workspace. Takes 10 minutes to set up.
2. mTLS between services. Service A can't talk to Service B unless it has a valid cert. No more "trust the internal network."
3. Short-lived tokens. 1 hour, then re-auth. Annoying? A little. Secure? Yes.
# Cloudflare Access - example policy # Allow: engineering@company.com # Deny: everyone else # Require: MFA + company device
My advice: Don't try to build Google's BeyondCorp on day one. Start with Cloudflare Access + MFA. That's 80% of the win for 10% of the work. You can add the fancy stuff later.
And for the love of god, don't buy a $50k zero-trust platform before you try the free tier. I almost did. Glad I didn't.