Zero Trust for SMEs: 4 steps and 90 days with managed IT

Verizon's 2026 Data Breach Investigations Report is clear about SMEs. In 55% of the breaches studied a third party was involved: supplier, partner or service provider. In 45% there was a human factor, such as a wrong click or a password reused on another service.

None of these doors is closed by a perimeter firewall. The attacker does not force entry; they use valid credentials. From there, in a traditional model, the whole company is open to them.

With Zero Trust, the damage from a compromised account is confined to that person and a fraction of the systems. For the board, that means less downtime, less exposed data and a very different conversation with clients and the insurer.

The old model was a fortress. A strong firewall around the outside and total freedom inside. It worked when everyone was in the office and the data lived on a local server.

Today there is remote working, Microsoft 365 in the cloud, smartphones and providers connecting remotely. The wall is full of holes.

Zero Trust works like an airport. Getting through the terminal door puts nobody on a plane. The boarding pass is checked at security, again at the gate, and is valid for one flight and one seat only. Your systems adopt the same discipline.

Step 1. Identity: make the password insufficient

• Mandatory MFA First for administrators and Microsoft 365, then for every service.
• Leavers closed the same day Whoever leaves the company loses access that day, not weeks later.
• Administrators counted Two or three named people, with a separate account used only for administration.
• An end to generic accounts "info@" or "shop1" can no longer be used to log in to systems.

No other step gives so much for so little. With MFA, a password captured by phishing is no longer enough. Most Microsoft 365 licences carry no extra cost for it: the work is organisational. Go deeper in MFA in the company and password managers for teams.

Step 2. Devices: only compliant ones get in

• A complete inventory Every laptop, desktop and phone that touches company data.
• Protection and patching Switched on and verified across the whole estate.
• Conditional access Microsoft 365 only opens data to devices that meet the rules.

The first fix is unsupported systems. Windows 10 has been on that list since 14 October 2025. Find out how to handle Windows 10 end of support.

Step 3. Network: an infected workstation cannot reach the servers

The flat network ends. Workstations, servers, visitors, printers and cameras move onto their own segments. Between them, the managed firewall decides what traffic passes.

The result: a laptop with malware stays trapped in its segment and cannot encrypt servers or backups. If you already have manageable switches and a managed firewall, this is configuration work, not a purchase.

Step 4. Least privilege: each person sees only their own work

• Permissions audited Shared folders, SharePoint and Teams reviewed.
• Users without administrator rights On their own computer included.
• Remote access to the application, not the network We explain why in VPN is no longer enough.

This step changes habits, so it comes last. But it has become urgent: Copilot and other AI tools show each user everything they have permission to see. First define the rules for ChatGPT and Copilot in the company.

A typical schedule for 10 to 200 workstations, with a dedicated IT partner and management involved:

Behavioural analytics, per-application micro-segmentation and continuous device posture assessment exist and have value. For most SMEs, however, they are expensive and return little until the four steps are complete.

The sequence matters. MFA alone protects the accounts and leaves the network exposed. Segmentation alone protects the network and leaves the accounts exposed. You need both.

Reltio by SAP, a US data software company, has a Lisbon office with ongoing maintenance and network managed by DataRoad. That means 125 structured network points, a firewall, three switches and Cisco Meraki access points, plus specialist support for 35 Dell machines and 40 MacBook Pros.

It is step 2 in practice: a mixed estate, with the same policy for every operating system. When the inventory exists and the network is managed from a single point, Zero Trust stops being theory and becomes routine.

We analyse identities, devices, network and permissions, tell you your current level and deliver the plan for the next 90 days. Firewalls, endpoint protection, MFA and alerting are part of the managed cybersecurity included in the IT Unlimited Premium plan. Request a no-commitment proposal.

More than 10 workstations · support contract · remote, on-site and telephone support. +351 211 459 950 * · sales@dataroad.pt

*Call to a Portuguese landline.

• Verizon: 2026 DBIR, executive summary with SME data
• EUR-Lex: Directive (EU) 2022/2555, NIS2, Article 21
• Microsoft Learn: Windows 10 lifecycle