Zero Trust Is Rising, But Many Businesses Are Still Behind
Zero Trust is no longer a future concept or an enterprise-only strategy. It is quickly becoming the standard for how modern businesses approach cybersecurity.
Across the MSP landscape, adoption is accelerating, but not evenly. Recent discussions at Zero Trust World highlighted a clear trend: while MSPs understand the importance of Zero Trust, many organisations are still in the early stages of implementation. That gap is where risk begins to build.
What Zero Trust Actually Means (Without the Buzzwords)
Zero Trust is often misunderstood as a product or a one-off project. In reality, it is neither.
At its core, Zero Trust is a mindset. It shifts the approach from assuming trust to continuously verifying it. Instead of relying on location or network boundaries, it focuses on identity, access, and ongoing validation. It is about ensuring that the right people have the right level of access at the right time, and nothing more.
In practical terms, this means moving away from legacy approaches and towards tighter control, greater visibility, and more deliberate access management. Done correctly, it simplifies security rather than complicating it.
Why Adoption Is Slower Than It Should Be
Despite the clear direction of travel, many businesses across the UK and Europe are still behind in adopting Zero Trust principles.
One of the main barriers is perception. For a long time, Zero Trust has been associated with enterprise-level cost and complexity. That perception is now outdated, but it still influences decision-making.
There is also a lack of clarity. Without a clear, practical explanation of what Zero Trust looks like in reality, it can feel abstract or overly technical. When something feels unclear, it is easy to delay it.
Finally, many organisations still take an incremental approach to security, only making changes after an incident has occurred. The challenge with that mindset is that the cost and disruption of reacting to a breach will always outweigh the effort required to prevent one.
“The maturity of our Zero Trust Strategy today is around 50%. We have a number of tools implemented within select customers (those on our core and advanced packages), and are actively testing replacement products to legacy services such as VPNs, but a full solution is not really in place. Costs and customer appreciation are part of that factor.
In the next year or so we will evolve this strategy. We are finding more solutions that are working well, and as the market is maturing the price points are becoming more reasonable. Being an MSP to customers of around 15 people plus, the enterprise equivalent solutions are now becoming more accessible to us.
When it comes to customer understanding - we are driving the conversations. Our customers rely on us for the strategy and direction they should be looking at to improve their security and ultimately use technology to help run their business. But it still needs to be uncomplicated or they simply won’t engage.”
What We’re Seeing at Sunrise
At Sunrise Technologies, we are actively evolving our own Zero Trust strategy alongside our clients. As Simon Gurnerexplains, the journey is well underway, but not yet complete.
“The maturity of our Zero Trust strategy today is around 50%. We have a number of tools implemented within select customers and are actively testing replacements for legacy services like VPNs, but a full solution is not always in place. Cost and customer understanding still play a role.”
This reflects what many growing businesses are experiencing. The direction is clear and the intent is there, but adoption takes time. Encouragingly, the market is maturing quickly, and the tools required to deliver enterprise-grade security are becoming far more accessible.
“As the market matures, price points are becoming more reasonable. Enterprise-level security is now within reach for businesses of around 15 users and above.”
The Real Shift: From Tools to Strategy
One of the most important changes happening in the market is not technical, but strategic.
Most customers are not explicitly asking for Zero Trust. Instead, they are asking how to reduce risk, how to remain compliant, and how to protect themselves against increasingly sophisticated threats such as AI-driven attacks.
Zero Trust is the framework that answers those questions, whether it is labelled as such or not. This is where the role of the MSP becomes critical. It is no longer just about delivering tools, but about guiding the direction of security in a way that makes sense for the business.
As Simon highlights, that guidance must remain simple and accessible. If security feels overly complex, engagement drops. The challenge, and the opportunity, is to deliver high-level protection in a way that feels practical and manageable.
Why This Matters Now More Than Ever
The threat landscape is evolving rapidly. AI-driven impersonation, identity-based attacks, and increasingly sophisticated phishing techniques are changing how breaches occur.
Traditional perimeter-based security models are no longer enough. The idea that being inside a network means being trusted has become outdated.
Zero Trust addresses this shift by focusing on identity, verification, and continuous control. It reduces the reliance on assumptions and replaces them with a more resilient and adaptive approach to security.
What Businesses Should Do Next
Adopting Zero Trust does not require a complete transformation overnight. In fact, the most effective approach is gradual and structured.
The key is to begin with a clear understanding of your current position and then take deliberate steps to improve identity controls, access management, and overall visibility. Reducing reliance on legacy systems and strengthening authentication methods are often the first meaningful moves.
What matters most is having a clear direction and a partner who can guide that journey in a way that aligns with how your business operates.
Final Thought
Zero Trust is not a trend or a temporary shift. It is the direction that modern security is moving towards.
Businesses that delay adoption risk falling behind, not only in terms of security, but also in their ability to meet evolving compliance requirements and customer expectations.
The good news is that progress does not need to be immediate or overwhelming. What matters is starting, and starting with clarity.
This article has been written after reading IT Europa’s article from the Zero Trust World event in February 2026.