Zero trust is not a box you buy

Every few months a CIO tells me, “We have bought zero trust.” What they have bought is a licence — sitting in a drawer while the network runs exactly as before: flat, permissive, one stolen credential from a very bad week. Thirty years of building and auditing Indian networks taught me this: zero trust is a design discipline, not a product. Vendors sell boxes. A zero trust consultant in India earns his fee by drawing boundaries — who may reach what, from which device, under which conditions — and making those boundaries hold in production.

The concept is simple: never trust, always verify. No user, device or application gets access because of where it sits; every request is authenticated and authorised, every time. Execution is where engagements live or die — your network accreted over fifteen years of mergers, urgent projects and vendor defaults; unpicking it without stopping the business is the actual job.

Zero trust consultant in India — architecture design by Sanjay Seth

What a zero-trust engagement actually looks like

Forget the maturity-model posters. On the ground it comes down to four workstreams that must move together.

Identity becomes the perimeter

The first boundary I draw is around identity, not subnets: a proper directory, multi-factor authentication that is actually enforced, and role definitions reflecting what people do. In most enterprises I audit this is the weakest layer: shared accounts, service accounts with domain admin rights, MFA covering email and nothing else. Fix identity first; every later control depends on it.

Device posture and NAC

The second question after “who” is “from what”. A director’s managed laptop and a contractor’s personal phone should not get the same answer. Network access control ties admission to posture — patched, encrypted, running the endpoint agent — and pushes unknown devices into quarantine instead of onto the LAN. This is where zero-trust rhetoric quietly dies — somebody must enumerate every printer, camera and badge reader that cannot run an agent.

Micro-segmentation

Once you know who and what, you stop letting everything talk to everything. Finance servers need not be reachable from guest Wi-Fi; the ERP need not chat with the marketing VLAN. Micro-segmentation carves the network into small zones with explicit, inspected paths between them, so a compromise in one zone stays there. When ransomware lands — and it is when, not if — segmentation is the difference between an incident and a catastrophe.

ZTNA replaces the VPN

The traditional VPN is the antithesis of zero trust: one password, and the remote user lands on the network as if they were in the office. Zero Trust Network Access inverts this: users connect to specific applications, not the network, and every session is verified against identity and posture. For the hybrid workforce every Indian enterprise now has, this is usually the programme’s most visible win.

The sequencing problem nobody warns you about

Most zero-trust projects stall on sequencing, not technology. You cannot flip a flat network to a segmented one on a Friday night and hope — I have cleaned up after exactly that attempt, more than once.

My rule: every step must be reversible. I segment the way you would renovate an occupied building — floor by floor, never all at once.

  • Observe before you enforce. Run segmentation and NAC tooling in monitor-only mode for several weeks and let it show you what actually talks to what — the real traffic map is never the diagram in the filing cabinet.
  • Start with a forgiving zone. A branch office or non-critical VLAN, where a wrong policy inconveniences thirty people rather than three thousand. Prove cutover and rollback there.
  • Move zone by zone, each with a tested rollback. Every cutover has a written, rehearsed reversal. If Monday morning breaks, you are back to the old state in minutes.
  • Enforce in warning mode first. Policies run alert-but-allow for a cycle before they deny. The exceptions this surfaces are the ones that would have been 2 a.m. outage calls.

Done this way, you reach zero-trust posture without a single unplanned outage. Done the other way, the programme gets blamed and shelved — which is how most “we tried zero trust” stories end.

Where Fortinet fits — and where it does not

I have deployed Fortinet for years — my team at PJ Networks is a Fortinet MSSP-level partner — so let me be specific. FortiAuthenticator provides the identity backbone — MFA, certificates and single sign-on feeding policy decisions. FortiClient with its ZTNA agent handles device posture and per-application access, replacing the VPN concentrator. FortiNAC does admission control and device profiling. The Security Fabric ties FortiGate segmentation, endpoint agent and authenticator into one policy plane, so rules follow identity rather than IP addresses.

If you already run FortiGate, this is the pragmatic path — extending a platform your team knows rather than bolting on a second vendor. My team has published a zero-trust architecture design and implementation guide for India with the component-level detail.

The honest part: Fortinet, like every vendor, will happily sell the whole catalogue whether your design needs it or not. The stack cannot decide your access policy, tell you which applications finance genuinely needs, or negotiate with the factory manager whose twenty-year-old SCADA kit cannot run an agent. In a multi-vendor estate, forcing everything into one fabric for ideological purity creates more problems than it solves. Design comes first; products serve it — that ordering is the entire value a consultant brings.

The failure modes I get called to fix

Much of my zero-trust work is rescue work. The patterns repeat:

  • ZTNA bought as a licence, never enforced. The agent is deployed, the dashboard looks impressive, and the old VPN still runs in parallel because “a few people had trouble”. Six months later, everyone is back on the VPN.
  • Segmentation drawn on paper, never applied. A beautiful zone diagram in the audit file, and firewall policy that still says any-any between the zones. The drawing satisfied the auditor; it never touched the traffic.
  • Identity exceptions that swallowed the rule. MFA for everyone except directors, developers and service accounts — which is to say, nobody who matters to an attacker.
  • No owner after go-live. Zero trust is an operating posture, not a project. When the programme team disbands, policy drift quietly erodes the boundaries back to flat.

None of these are technology failures; they are governance failures, preventable with honest sequencing and an owner who outlives go-live.

What zero trust will not fix

Before you spend the money, the caveats. Zero trust will not fix applications that are themselves insecure — a vulnerable ERP behind perfect access policy is still a vulnerable ERP. It will not stop a determined insider who already holds legitimate access, though segmentation limits how far they roam. It does not replace patching, backups or a monitored SOC; it makes each more effective by shrinking the blast radius. And it cannot be bought finished — anyone who implies otherwise is selling you the licence-drawer outcome from the top of this page.

How I work

My engagements follow the same arc whether the client is a Gurgaon bank or a Pune manufacturer:

  • Assess. I map your real traffic, identity estate and device inventory, and read the firewall policy you actually run. You get a written picture of where you stand — usually very different from the assumed one.
  • Architect. I design the boundaries — identity policy, segmentation zones, device posture rules, the ZTNA model — sequenced into reversible phases sized to your team’s capacity.
  • Deploy. I work hands-on alongside your engineers through the zone-by-zone cutovers. I do not hand over a document and disappear.
  • Operate. I set up the review cadence, exception process and ownership so the posture holds after I leave. If you would rather have it run for you, my team at PJ Networks operates managed network infrastructure and managed IT services around the clock.

My background is on the sanjayseth.com homepage and the about page.

Frequently asked questions

How long does a zero-trust rollout take for a mid-size Indian enterprise?

For 500 to 2,000 users, a realistic timeline is nine to eighteen months from assessment to enforcement. The first wins — MFA everywhere, ZTNA replacing the VPN — usually land inside the first quarter. Micro-segmentation of the core data centre is the long pole — traffic observation alone needs four to eight weeks per zone. Anyone promising ninety days is quoting the licence installation, not the design work.

Do we need to replace our firewalls?

Usually not. Most next-generation firewalls deployed in the last five years already support identity-based policy and segmentation; they are simply not configured to do it. I replace hardware only when it cannot do the job — end-of-support units or appliances with no identity integration. Much of my work is extracting zero-trust value from equipment you already own.

What does a zero-trust consultant charge?

It depends on scope. A standalone assessment and architecture design typically runs a few lakh rupees; a full programme with hands-on deployment support is priced on estate size, site count and how much of the work your own team absorbs. I quote after the assessment, never before — anyone quoting blind is guessing, and you pay for the guess.

Can zero trust work with legacy applications?

Yes, with accommodation. Systems that cannot support modern authentication or agents go into tightly controlled segments of their own, with access brokered through a gateway that enforces policy on their behalf. The honest caveat: the application remains vulnerable inside its zone — segmentation contains the risk, it does not cure it.

ZTNA vs VPN — when should we switch?

Switch when any of these are true: your remote workforce is permanent rather than occasional; VPN users reach more of the network than their role needs; or a VPN concentrator refresh is due and the budget can be redirected. A small office with a handful of remote admins on managed devices may still find a hardened VPN proportionate. The trigger is risk and scale, not fashion.

Where do we start?

With visibility, not purchases. Map your traffic, identities and devices, and fix the identity basics — MFA and account hygiene — before any segmentation. These steps cost little, reduce risk immediately, and produce the data every later decision depends on. A structured assessment is the sensible first engagement.

Talk to me about your network

If your organisation is weighing zero trust — or sitting on licences that never became policy — start with a working session. I will look at what you have, tell you plainly what is worth doing, in what order, and what you can skip. Book a working session and we will take it from there.

Based in Delhi, working with enterprises across India.