Coro's Mythbuster Series—Myth No. 13: SMBs Can't Deploy ZTNA

Forbes

08-07-2025

Dror Liwer is cofounder at Coro.
Myth: Zero trust network access (ZTNA) is a complex, expensive cybersecurity solution only accessible to large enterprises with dedicated IT teams and massive budgets.
Myth Busted: This myth is as outdated as dial-up internet. The reality is that modern ZTNA solutions are not only accessible but crucial for SMBs, offering robust security without the prohibitive costs or complexity of traditional models.
What ZTNA Is
Imagine your office building. Traditionally, once you're past the main entrance, you have free rein to roam most areas. This is akin to the old "castle-and-moat" security model, where strong perimeter defenses are built and everything inside is inherently trusted.
Now, imagine a different scenario: every door in your office, from the main entrance to the broom closet, requires authentication. Even if you're an employee, you only get access to the specific rooms you need for your job, and your access is continuously verified. This is, in essence, ZTNA.
ZTNA operates on the principle of "never trust, always verify." Instead of assuming everything inside your network is safe, the goal of ZTNA is to verify every user and device, for every connection, regardless of their location. This micro-segments your network, granting access only to the specific applications and data a user needs and nothing more. This is a crucial concept, especially when you consider that a significant percentage of security incidents involve internal actors.
Why ZTNA Has Been Out Of Reach
For a long time, the perception of ZTNA was that it required a complete overhaul of existing network infrastructure, demanding specialized expertise and significant financial investment. This was true for early ZTNA iterations, which were indeed designed with large enterprises in mind. The complexities of integration, ongoing management and the need for in-house security professionals made it seem like a distant dream for most SMBs.
It's a bit like the "Ferrari Syndrome" we discussed in Myth No. 9. Just because a high-end security solution exists doesn't mean it's practical or manageable for every business. Many SMBs assumed ZTNA was a Ferrari they couldn't afford to buy or drive.
The New Reality: ZTNA For Every Business
The cybersecurity landscape has evolved dramatically. With the rise of remote and hybrid work models, employees are accessing company resources from various locations and devices. Many SMBs now work with a variety of contractors, freelancers and vendors. Breaches have become more common than ever before.
The good news is that ZTNA capabilities have evolved as well, ensuring that every connection is secure, regardless of where your employees are working. It allows you to grant contractors highly granular access to only the specific resources they need, for a limited time, without exposing your entire network. And by limiting lateral movement and isolating breaches, ZTNA helps reduce the impact of ransomware attacks, preventing them from spreading across your entire network.
Here's how ZTNA has become more accessible to SMBs:
Advancements in cloud-native and SaaS-based ZTNA offerings have changed the complexity traditionally associated with network security. By removing the need for on-premise hardware and simplifying infrastructure requirements, this offers a more manageable entry point for smaller organizations. It's like tapping into services that are maintained and updated externally rather than building your own data center.
Many modern ZTNA platforms emphasize usability, with simplified interfaces and integration paths that reduce setup friction. By aligning with existing identity and access management tools, these systems can be incorporated into current environments without demanding deep in-house expertise. For many SMBs, this means security upgrades can be implemented without needing to expand their IT teams.
ZTNA can shift the financial model from capital expenditures to operational ones, helping SMBs better manage costs while still improving security. Additionally, by consolidating multiple security functions, ZTNA reduces the need for a sprawling toolkit. This directly counters the "more tools equals stronger cybersecurity" myth.
ZTNA's core principles—like least-privilege access and segmenting users from resources they don't need—align well with the types of risks SMBs often face, particularly insider threats and lateral movement by attackers. These controls can help reduce "dwell time," the length of time adversaries remain undetected in a system, even when a breach occurs.
As SMBs evolve, the ability to scale security measures without rebuilding infrastructure becomes critical. ZTNA solutions can typically grow in step with the organization—supporting additional users, devices and cloud applications—without requiring disruptive overhauls.
Taking Action: Deploying ZTNA As An SMB
Implementing ZTNA doesn't have to be a daunting task for an SMB. Here's how to approach it:
You don't need to implement ZTNA across your entire organization all at once. Begin by protecting your most critical applications and data and then expand gradually.
When exploring ZTNA options, look for providers that specifically cater to SMBs.
Cloud-native, easy-to-manage solutions with transparent pricing should also be a key focus, as should an emphasis on integration and automation. These aspects can significantly lighten the load on smaller IT teams.
As discussed in Myth No. 9, identify your most critical assets and the primary threats to them. This will help you prioritize your ZTNA deployment and ensure you're getting the most impact for your investment.
While ZTNA reduces reliance on individual vigilance for perimeter security, it's still crucial to train employees on good cybersecurity hygiene. This helps combat the "Bagel Effect' we discussed in Myth No. 10 where everyone assumes someone else is handling security.
Conclusion
The myth that SMBs cannot deploy ZTNA is well and truly busted. For small- and medium-sized businesses navigating today's complex threat landscape, the ability to build a stronger, more resilient security posture is well within reach—proving that advanced cybersecurity is indeed for anyone who wants to protect their digital crown jewels.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?