Mid-market insurance carrier, 5,000 employees, 30 offices

A mid-market insurance company with 5,000 employees spread across 30 offices in 12 states relied on a traditional perimeter-based security model for remote access. Employees working from home or traveling connected through a corporate VPN that granted broad network access to internal systems once authenticated: the VPN was the single gate between the untrusted internet and the trusted internal network, a classic castle-and-moat architecture that had served the company for over a decade.

That model collapsed when a credential-stuffing attack compromised 200 employee accounts in a single weekend. Attackers used credentials exposed in third-party data breaches to authenticate to the VPN with valid usernames and passwords. Because the company had not yet enforced multi-factor authentication on VPN access (citing employee pushback on workflow friction), the attackers gained full network access with legitimate credentials. The breach was discovered Monday morning when the IT help desk received an unusual volume of password reset requests from locked-out employees.

Forensic investigation found that the attackers had accessed file shares containing policyholder personal information, browsed internal claims processing systems, and attempted to access the financial reporting database. While quick incident response ultimately limited actual data exfiltration, the breach exposed the fundamental weakness of the perimeter-based trust model. The board approved an emergency initiative to modernize the security architecture, and the CISO brought me in to design and deploy a Zero Trust framework.

I designed a phased Zero Trust architecture deployment spanning eight months, structured to minimize disruption to business operations while systematically eliminating implicit trust from the network. The approach addressed four foundational pillars: identity-based access controls, device health verification, micro-segmentation, and continuous authentication.

Pillar 1: Identity-Based Access with Conditional Access Policies

The first priority was replacing the all-or-nothing VPN access model with granular, identity-based access controls. I worked with the company's IT team to implement a Zero Trust Network Access (ZTNA) platform that authenticated individual users and authorized access to specific applications based on their role, department, and current risk context.

The conditional access policies evaluated multiple factors before granting access to each application: the user's identity and role, the sensitivity of the requested resource, the device's compliance status, the user's geographic location and network context, and behavioral signals such as unusual access times or atypical application usage. A claims adjuster accessing the claims management system from a managed laptop on a known network would get seamless access, while the same user attempting to reach financial reporting systems from a personal device on an unfamiliar network would trigger step-up authentication or denial.

Every internal application and data source was mapped to a sensitivity tier with access policies aligned accordingly. Tier 1 resources (policyholder databases, financial systems, executive communication platforms) required managed devices, MFA, and in some cases on-network proximity. Tier 4 resources (the company intranet, training portals) were accessible with standard authentication from any compliant device.

Pillar 2: Device Health Verification

Zero Trust requires verifying not just who is accessing a resource, but whether the device they're using meets security standards. I integrated device health checks into the access decision process, requiring endpoints to meet a compliance baseline before being granted access to any corporate resource.

The baseline included up-to-date OS patches, active endpoint protection with current signatures, enabled disk encryption, a compliant firewall configuration, and the absence of known malicious software indicators. Devices that failed compliance checks were granted limited access to remediation resources (the IT help desk portal, security update servers, documentation) but blocked from business applications until compliance was restored.

For employees using personal devices, I deployed a bring-your-own-device (BYOD) tier providing access to a limited set of applications through a managed browser container without requiring full device enrollment, balancing security requirements with employee flexibility and reducing the friction that had previously caused pushback against security controls.

Pillar 3: Micro-Segmentation of Sensitive Environments

The traditional flat network allowed any authenticated user to potentially reach any internal system. I implemented micro-segmentation to isolate sensitive data environments and restrict lateral movement: the policyholder database, claims processing platform, underwriting systems, and financial reporting tools were placed in isolated network segments with strict access controls.

Each segment enforced its own access policies independent of network connectivity, so even a compromised endpoint with network access couldn't move laterally to sensitive systems without additional authentication and authorization at the segment boundary. Software-defined micro-segmentation enforced policies at the workload level, providing granular control that traditional VLAN-based segmentation couldn't achieve.

I also segmented development and testing environments from production. The previous architecture had let developers access production databases for debugging: a common but dangerous practice. Under the new architecture, production data access requires explicit approval through a just-in-time access workflow with automatic session recording and time-limited grants.

Pillar 4: Continuous Authentication

Traditional authentication validates identity at login and then trusts the session for its duration. Zero Trust requires continuous validation throughout the session, so I implemented continuous authentication that re-evaluates access decisions based on real-time signals as the session runs.

If a user's behavior deviated from established patterns (accessing an unusual volume of records, downloading data they typically don't interact with, switching between applications in a pattern associated with data harvesting), the system triggers step-up authentication requiring re-verification through MFA. Persistent anomalies terminate the session and alert the security team.

The credential-stuffing incident had already created organizational awareness of security risk, but deploying Zero Trust still required significant change management. I developed a phased rollout strategy prioritizing departments handling the most sensitive data (claims, underwriting, finance) in the first two months, followed by operations, sales, and administrative functions.

Each rollout phase included department-specific training sessions, detailed documentation of new access procedures, dedicated support channels for the first two weeks post-deployment, and feedback loops that let policies get adjusted based on real-world usage. I identified and addressed over 150 policy exceptions during the rollout, most involving legacy applications requiring specific network connectivity patterns incompatible with strict micro-segmentation.

The eight-month rollout successfully migrated all 5,000 employees to the Zero Trust architecture with minimal business disruption. The phased approach, extensive change management, and responsive policy adjustment meant employee satisfaction with the new access experience actually improved compared to the previous VPN model. Users appreciated accessing applications directly through a web portal rather than establishing a VPN connection, and the conditional access policies operated transparently for the majority of legitimate access scenarios.

In the 12 months following full deployment, the company experienced a 40% reduction in security incidents compared to the preceding year. Credential-stuffing attacks were effectively neutralized by MFA enforcement, lateral movement was prevented by micro-segmentation, and continuous authentication detected and terminated two compromised sessions before attackers could access sensitive data. The CISO reported to the board that the Zero Trust deployment had transformed the company's security posture from a brittle perimeter model to a resilient, identity-centric architecture.

The credential-stuffing attack was the wake-up call we needed. Kishin turned that crisis into an opportunity to build a security architecture that doesn't just defend against yesterday's threats: it's designed for the threats we'll face tomorrow.