Startups hear "zero trust" and picture a security department, a compliance binder and a year of meetings. In reality, the startup-sized version is about seven decisions — and you can make most of them on day one without paying for a single new tool.
Identity before network
The entire model fits in one sentence: nothing trusts the network. Every request is authenticated and authorised at the service boundary, not the perimeter. For a startup, that means real IAM from the first commit — SSO with MFA for humans, short-lived machine tokens for services, and no shared credentials anywhere.
Your first leaked credential is not a question of if, but when. Zero trust is the difference between a Tuesday incident and a headline.
The seven decisions
- SSO with MFA enforced on the domain, not optional.
- A service token system (workload identity) that expires in hours.
- Secrets in a vault, not in .env files committed to git.
- Environment separation that survives an import typo.
- A logging pipeline that captures identity on every event.
- Least-privilege roles named by job, not by person.
- A quarterly access review calendar entry that actually happens.
Why this is cheaper now than later
Every one of those decisions is dramatically more expensive to retrofit after you have 40 employees, 12 integrations and a SOC 2 deadline. We regularly meet Series B companies who would pay anything to time-travel to the moment we're describing.
So build it now: identity-first, least privilege, and no software you'll have to apologise for in three years.
All seven decisions are standard in our security engagements, and they pair naturally with the platform work that follows.