Zero-Trust Transformation

The problem this solves

"Our security still basically means VPN-in-and-you're-trusted. Remote work, contractors, and SaaS broke that model years ago, and we know one stolen laptop or credential gives an attacker lateral access far beyond what that identity should ever need. Vendors keep pitching us a zero-trust product; we need the actual architecture and enforcement, not a logo." Root cause: implicit network trust + flat internal access means a single compromised identity or device has lateral reach far beyond its need; ZTNA products without an access-policy model just relocate the problem.

What you own when we leave

• An access-policy model expressed as policy-as-code (identity + device posture + resource sensitivity → allow/deny), in your repo.
• Terraform/IaC for the enforcement points in scope (identity-aware access, segmentation, conditional access, service-to-service auth).
• A threat model showing lateral-movement paths before and after, so the risk reduction is legible and reviewable.
• Phased rollout runbooks (so you cut over without locking your own people out) and break-glass procedures.
• ADRs for the trust-boundary and enforcement decisions.

Not a maturity-model spreadsheet. A working enforcement model defined as code.

How we approach it

1. 01

   Discovery

   We read your accounts, configs, and constraints directly (scoped read-only access or exported state), map the real current state, and agree on a written scope and success criteria before any code is written.

2. 02

   Architecture Decision Records

   We write down the key decisions — what we’re doing, the options we rejected, and why — as ADRs in your repo, so the reasoning survives long after we’re gone and you can challenge it before we build.

3. 03

   Implementation

   We build the solution as reviewable Terraform/IaC in small, tested pull requests against your CI, so you watch it land incrementally and nothing arrives as a black box.

4. 04

   Handover

   We walk your team through the repo, the threat model, and the runbooks live, confirm you can apply/destroy/extend it yourselves, and then we leave. You own everything — there is no phase 5 where you still need us.

Engagement shape

A fixed-scope transformation over a defined set of users, applications, and access paths — phased so each cutover is reversible and observed. Scope is bounded by which access paths and enforcement points are in the first phase, agreed up front.

Engagements typically start at $40,000 USD. Contact for scope and a fixed price.

A sample of what we ship

# policy/access.rego — identity + device posture + sensitivity
package access

default allow := false

allow if {
  input.user.mfa_verified
  input.device.managed
  input.device.disk_encrypted
  resource_tier_permitted
}

resource_tier_permitted if {
  input.resource.tier != "restricted"
}

resource_tier_permitted if {
  input.resource.tier == "restricted"
  input.user.group in data.restricted_access_groups
  input.device.posture_checked_within_hours <= 24
}