In 2023, NBConsult joined forces with Microsoft to assist in developing a Zero Trust Adoption Framework. Since then, we have learned that the lessons are rarely related to this framework’s theory, but rather about where organisations get stuck putting it into practice.

It’s not the theory, but the practice

NBConsult’s contribution to the Zero Trust framework has significantly helped shape the resources businesses are now using to plan their move from perimeter-based security. Practically, this has shown us that when most vendors are referring to Zero Trust, they have not yet had the chance to really check that its three core principles are sound:

1. Verify explicitly,
2. Use least privilege access,
3. Assume breach.

These principles were sound and intact when NBConsult and Microsoft first published the framework, and in theory they still are today. But it was never theory where organisations went wrong.

We’ve learned that organisations usually trip once the theory has to be implemented and applied on a day-to-day basis. It’s not just in the technical layer, but somewhere between the security team’s plan and the rest of the business. It usually lies in the part of the Zero Trust Adoption Framework that gets the least attention because it is the hardest to solve without a policy document.

What the Zero Trust Adoption Framework really asks of businesses 

When breaking down the three framework principles, they are really straightforward and easy to understand.

1. Verify explicitly means every access request is checked on its own merits, such as identity device, location or behaviour, rather than just assuming safety just because it originated from inside the corporate network.
2. Least privilege access means people and systems only get the access they need for their current task, not standing access held for “just in case”.
3. Assume breach means designing on the basis that an attacker is already inside your system somewhere. The mission is not only to keep the front door locked, but more importantly to limit how fast attackers can move and limit what they can reach.

Microsoft had organised the framework around business scenarios, identity, endpoints, data, apps, infrastructure and network, each with its own actionable steps. This was so that these organisations could adopt the framework in stages rather than needing a full overhaul before any benefit was evident. On paper, that is a considered, well sequenced way to approach the Zero Trust security strategy.

NBConsult founder and CTO, Nicolas Blank, describes the framework as a genuine step forward in how the industry thinks about security.

“Zero Trust stops treating security as a discipline that sits apart from the rest of the business. It rather builds it around how the business actually operates, scenario-by-scenario, rather than product-by-product.”

Where the Framework Holds Up on Paper and Falls Apart in Practice

Sequencing is the easiest part to get right. What is far more difficult is getting the Zero Trust way of thinking to reach beyond just the team that wrote the policy. In the Zero Trust implementation challenges we witness; this gap is often the real subject.

Nicolas Blank traces it back to inclusion, not the technology. Discussing the framework’s development, he shares:

“We wrestled with how to deliver Zero Trust thinking in an inclusive manner across the entire organisation, in order to encourage more participation, from security analysts all the way to senior leadership. But ultimately, it is about getting through to the normal human that is most often affected by a security breach.”

Nicolas precisely captures the essence of what businesses are still practically struggling with even years after the framework’s publication. The security team can lock down the privileged access, segment the network and even tick every box of the framework, and still watch the effort stall once it reaches people outside of the team.

A business unit lead was never told why a new approval step exists and finds a way around it. A frontline employee routes around a control nobody cared to explain to them, because it felt like the quickest path. Leadership often signs off on strategies without considering or adjusting to the actual daily business behaviours.

None of these examples point to a technology failure, but rather an operational and implementation issue related to Zero Trust adoption. The framework’s own structure is not meant to solve this on its own, it rather depends on the daily employees who were never even in the room when the policies were written.

It is easy to underestimate, but there is a cost to only adopting this framework half-way. It is not a safer middle ground but rather creates the appearance of protection without the substance behind it. The controls are configured correctly, the audit checklist looks clean, but the actual exposure barely moves. The gap exists in behaviour, not the configuration.

How NBConsult approaches Zero Trust differently

Because the real gap is organisational in nature rather than technical, we approach Zero Trust differently in that it is more than just the security function itself. Our consulting includes how leadership can frame and educate this strategy to the rest of the business, not just for the technical rollout. It’s not just the generic responses or advice that every advisory firm suggests about changing management. It is a direct response to practically witnessing the challenges and where the framework we’ve helped shape actually breaks once a business tries to fully implement it.

Our advisory position is informed by direct proximity to how the Zero Trust Adoption Framework was actually built, which gives us greater insight and starting point than partners trying to apply the framework from the outside. Furthermore, NBConsult is a proud Microsoft Solutions Partner with multiple Microsoft MVPs on the team, has been named Azure MSP of the Year in Hong Kong, and for the past two decades, worked with the security and infrastructure for organisations across South Africa, England and Hong Kong.

For organisations already committed to Zero Trust as a security strategy, NBConsult is helper in getting it to work day-to-day. Rather than just another restatement of the three principles or theory, we manage to implement Zero Trust as a business mindset – even for the people outside of the security team.

Don’t mistake the framework for the finish line

Before assuming your own rollout is further along than it is, it is worth testing honestly where it is thinnest: security team confidence, leadership behaviour, or frontline habits. Those rarely move at the same pace, and the gap between them is usually where the real exposure sits.

Get in touch with NBConsult to get started on implementing your Zero Trust strategy the right way!

Want to know more? Some of the most frequently asked questions about Zero Trust

What is Microsoft Zero Trust Adoption Framework?

A Microsoft resource that helps organisations move from perimeter-based security to a Zero Trust model, built around three important principles: (1) verify explicitly, (2) least privilege access, and (3) assume breach. The framework includes actionable steps organised by business scenario rather than just by product alone.

Why do so many Zero Trust rollouts stall after the technical work is done?

Because the harder part of Zero Trust adoption is organisational, not technical. It’s not just about the basic security team configuration, but also about adoption the Zero Trust way of thinking. Furthermore, this way of thinking needs to reach all the way to leadership, business behaviour and frontline habits.

How does NBConsult’s Zero Trust advisory differ from a standard implementation partner?

NBConsult’s advisory approach is informed by direct proximity to how the framework was actually built, and is designed to close the organisational gap, not just deliver the technical rollout.