# Zero Trust rollout: from VPN replacement to mature program

Source: https://startwithidentity.com/guides/implementation/zero-trust-rollout/
Last updated: 2026-07-16
License: content by Start with Identity. Cite the source URL.

---

Zero Trust is one of the most oversold terms in security, which makes a grounded rollout plan valuable. This is a staged sequence that starts where the value actually is, identity, and ends with a mature program rather than a product you bought and hoped for.

## What Zero Trust actually is

Zero Trust is a model, not a product. NIST SP 800-207 describes it as continuous verification of identity, device, and context for every access decision, with no trust granted by network location. The product category that delivers most of it is [Zero Trust Network Access](https://startwithidentity.com/guides/fundamentals/what-is-zero-trust/) (ZTNA), which brokers access to individual applications instead of dropping a connected user onto a flat internal network.

## The honest sequence

**Quarter 1: Foundation.** Modernize identity first. Single sign-on covering the large majority of applications. MFA enforced for all users, phishing-resistant for admins. Conditional access policies written and tested in report-only mode before enforcement. This quarter is the one that determines whether everything after it works.

**Quarter 2: ZTNA pilot.** Pick one critical internal application. Replace VPN access to it with a ZTNA gateway. Verify the user experience end to end, confirm audit visibility, and prove that access now depends on identity and device posture rather than network position.

**Quarters 3-4: ZTNA expansion.** Onboard the next tranche of applications, roughly twenty at a time. Sunset the corresponding VPN tunnels as each application moves, because the security benefit comes from retiring the old path, not from adding a new one beside it. Establish device posture signals as an input to access decisions.

**Year 2: Microsegmentation and continuous monitoring.** Add east-west controls to limit blast radius after a compromise, so a foothold in one segment does not become free movement across the estate. Integrate identity and access telemetry with the security operations center for real-time policy decisions.

**Year 2 ongoing: SaaS data controls.** Extend policy to SaaS traffic with a secure service edge or cloud access broker, inline data loss prevention, and browser isolation for risky destinations. This closes the gap between "the network is controlled" and "the data is controlled."

## Metrics to track

- Percentage of applications behind SSO and behind ZTNA, trending up each quarter
- Percentage of VPN tunnels retired, which should track ZTNA expansion, not lag it
- MFA coverage and phishing-resistant coverage for privileged accounts
- Mean time to revoke access for a departed user or compromised device
- Access decisions denied on posture, a sign the posture signals are actually being used

## Vendor decisions

The ZTNA layer is the high-use decision. [Cloudflare](https://startwithidentity.com/vendors/zero-trust/cloudflare/), Zscaler, Netskope, Palo Alto Prisma, and Tailscale represent different price-performance points; compare them in the [best Zero Trust tools](https://startwithidentity.com/rankings/best-zero-trust-tools/) ranking and the [top ZTNA tools](https://startwithidentity.com/articles/top-8-zero-trust-network-access-tools/) article. Microsegmentation is a separate purchase (Illumio, Akamai Guardicore, or native cloud controls). For the architectural underpinnings, see the [Zero Trust architecture implementation guide](https://startwithidentity.com/guides/architecture/zero-trust-architecture-implementation-guide/).

## Common pitfalls

- Buying ZTNA before identity hygiene is complete, which produces garbage-in, garbage-out access decisions
- Treating Zero Trust as a single project instead of a multi-year program with a roadmap and owners
- Skipping the VPN sunset, so both systems run indefinitely and you pay for the new model without retiring the old risk
- Underestimating change management for users moving from VPN to ZTNA, which drives support load and shadow workarounds
- Buying microsegmentation before basic posture signals are flowing, so the controls have no context to act on

Sequenced this way, Zero Trust stops being a slogan and becomes a measurable reduction in standing access and blast radius, one quarter at a time.