Zero trust means verifying every sign-in instead of trusting a password on its own. For a small business, that mostly comes down to three things: enforcing multi-factor authentication, using a managed password manager and adding single sign-on, so one stolen password can’t open everything.
Passwords get reused, shared in group chats and pasted into the wrong login page. “Zero trust” sounds like something you buy, but it’s a way of controlling access, and most small businesses can get a long way with it using tools they already pay for.
What is zero trust?
Zero trust is a security approach built on one rule: never assume a login is legitimate just because it comes from inside your network or has the right password. Each sign-in is verified, usually with a second factor, and each person gets access only to what they need. It’s a way of working, not a single product.
How much does MFA actually help?
A lot. A Microsoft study of Azure Active Directory accounts found that multi-factor authentication (MFA) reduced the risk of compromise by 99.22% across the population, and by 98.56% even where the password had already leaked. The same study found authenticator apps outperformed text-message codes, though both were far better than no MFA at all (Microsoft Research).
Two cautions. The study looked at accounts showing suspicious activity, and determined attackers can still get around weaker forms of MFA, for example by flooding someone with approval prompts until they tap yes. And identity isn’t the only door: Verizon’s 2026 report put credential abuse at 13% of initial access, behind software vulnerabilities at 31% (eSecurityPlanet summary). MFA is essential, but it’s one layer.
Access control is one part of a complete security plan. Our complete guide to cybersecurity shows where it fits, and our guide to customized cybersecurity solutions for business growth explains how to match controls to your size and risk.
What are the three building blocks?
| Control | What it does | Question to ask |
|---|---|---|
| Multi-factor authentication (MFA) | Asks for a second proof of identity, such as an authenticator app, on top of the password | Is it enforced on email, the VPN and every admin account, with no exceptions? |
| Managed password manager | Creates and stores strong, unique passwords and lets the team share logins without passing passwords around by email or chat | Are staff still sharing logins by email, spreadsheet or sticky note? |
| Single sign-on (SSO) | One secure login that opens all your business apps, so access can be granted and removed in one place | When someone leaves, how many separate places do we have to remove them from? |
What happens to access when someone leaves?
This is where the three controls pay off. Think about everything a former employee might still reach:
- Their email and calendar
- Cloud apps with their own logins
- The VPN
- Shared logins they know the password to
- A phone or laptop that still has the company account signed in
Without SSO, removing access is a checklist and a bit of luck. With SSO and a password manager, it’s one change, and the shared passwords they knew can be rotated in minutes.
Where should a small business start?
- Turn on MFA for email, the VPN and admin accounts first. Prefer an authenticator app or hardware key over text messages, and teach staff never to approve a prompt they didn’t trigger.
- Roll out a managed password manager. Move shared logins into it so nobody needs to know the password to use the account.
- Add single sign-on for the apps that support it. This cuts the number of separate logins and makes offboarding simpler.
- Write an offboarding checklist and test it. Run it on the next departure and note what you missed.
- Review who has access to what, regularly. People change roles; their access often doesn’t.
People are the other half of access security. Our guide to security awareness training for small business covers how to train staff to spot the phishing emails that steal passwords, and our post on securing your working PCs from cyberattacks covers the devices they sign in from.
How we help London businesses control access
Western I.T. Group is a managed IT provider based in London, Ontario. Identity and access controls are part of the protection we deliver through our WIT Protect cybersecurity service.
Want a second pair of eyes on your access setup?
We offer a short access review. We’ll look at where MFA is and isn’t turned on, how passwords are shared and how access is removed when people leave, then give you clear recommendations. Book your review with our London team, or call 519-936-8985. Western I.T. Group is at 415 Hamilton Road in London, Ontario.
Frequently asked questions
Is SMS-based MFA good enough?
It’s far better than no MFA. Microsoft’s research found authenticator apps performed better than text-message codes, though both gave much stronger protection than a password alone. Where you can, use an authenticator app or a hardware key.
What’s the difference between SSO and a password manager?
Single sign-on lets one secure login open many apps. A password manager stores strong, unique passwords for the sites and tools that can’t join SSO. Most businesses end up using both.
Does zero trust mean replacing all our systems?
No. It’s an approach, not a product. Many of the early gains come from switching on and enforcing features you already pay for, such as MFA in Microsoft 365 or Google Workspace.
Will MFA slow my staff down?
It adds a few seconds to a sign-in. Single sign-on reduces the number of separate logins people deal with, which usually offsets the extra step.
Does our VPN still need MFA?
Yes. A VPN is an entry point to your network, so a password on its own shouldn’t be enough to open it.