Key findings
Identity is the most effective starting point. Consolidating identity providers and enforcing strong multi-factor authentication addresses the credential-based attacks behind a large share of breaches, at lower cost and disruption than network redesign.
High confidenceAsset and device inventories are usually less complete than organisations believe, and access decisions based on device health are only as reliable as that inventory.
Moderate confidenceManaged detection and response services can close the skills gap for smaller security teams, but only when escalation ownership and permitted actions are agreed in advance.
High confidenceOrganisations that treat zero trust as a single product purchase rarely reach the later maturity stages.
Moderate confidence
Context
Zero trust has moved from a slogan to the expected security model for organisations of every size. Yet most published guidance assumes the resources of a large enterprise or government agency: dedicated architecture teams, multi-year budgets and a mature identity platform. Mid-size enterprises in India, typically with a security team of fewer than ten people, need a different path.
What we recommend
- Consolidate to one authoritative identity provider and require phishing-resistant multi-factor authentication for administrators and remote access first.
- Reconcile your device inventory against network and endpoint data before using device posture in access decisions.
- Put application-level access controls in front of your most critical systems before attempting network micro-segmentation.
- Define measurable exit criteria for each maturity stage and report progress to the board twice a year.
References
- National Institute of Standards and Technology. SP 800-207, Zero Trust Architecture. August 2020.
- Cybersecurity and Infrastructure Security Agency. Zero Trust Maturity Model, Version 2.0. April 2023.
- Cybersecurity and Infrastructure Security Agency. Implementing Phishing-Resistant MFA (fact sheet). October 2022.
- National Institute of Standards and Technology. SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management.
- Indian Computer Emergency Response Team (CERT-In). Directions under sub-section (6) of section 70B of the Information Technology Act, 2000. 28 April 2022.
- International Organization for Standardization. ISO/IEC 27001:2022, Information security management systems.
How we reached these conclusions
This report draws on 6 published regulations, standards and frameworks, listed in the references, applied through Krynthnode analysis. Vendor claims are never counted as evidence on their own. Each finding is graded in the Krynthnode confidence ledger, described on our methodology page, and the whole report is due for review by 2 February 2027.