Retire the VPN one application at a time. Start with the ones attackers want most.
A flat VPN gives a contractor's laptop the same reach as a domain controller. We score where you stand on the CISA Zero Trust Maturity Model. Then we move access to identity- and device-aware policy, one app at a time, using Microsoft Entra Private Access or the ZTNA service you already own.
Zero trust architecture means nothing is trusted by default, whether it's a user, a device or a network location.
Every request is checked against identity, device health and context. Cohash turns that into a sequenced plan. We assess maturity against CISA's model and design access policy. Then we replace VPN access with zero trust network access one app at a time and segment the systems that matter most. Most of the work is identity, which is our core practice.
you probably need this if
Contractors on the VPN can reach the subnets where the domain controllers sit.
Someone's password gets them in from a personal laptop just as easily as from a managed one.
The board asked for a zero trust plan and nobody knows which pillar to start with.
terms on this pageZero trustdefinitionA security model where nothing is trusted just because of where it sits. Every request gets checked against current evidence about the user, the device and the context.explained in a field note →
Zero trust architectIAM engineer (Conditional Access)ZTNA network engineer
Microsoft Certified: Cybersecurity Architect Expert
Microsoft Certified: Identity and Access Administrator Associate
From the first call to a setup your own team can run.
Here's what usually prompts a call about your Zero Trust Architecture, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · zero trust architecture3 open
openContractors on the VPN can reach the subnets where the domain controllers sit.
recurringSomeone's password gets them in from a personal laptop just as easily as from a managed one.
blockedThe board asked for a zero trust plan and nobody knows which pillar to start with.
exposure
Maturity assessmentAccess policy designVPN replacement with ZTNACrown-jewel segmentationDevice trustRoadmap and funding case
startrehearsehandover
Baseline
Target and sequence
Pilot
Scale
we are here
ready to hand over
The VPN profile gets smaller with every wave.
The committee now has a single plan with the current score, target stages and quarterly…
Maturity scorecard by pillar
Target architecture and access policy model
chapter 01 · where it hurts
Why teams reach out
Contractors on the VPN can reach the subnets where the domain controllers sit.
Someone's password gets them in from a personal laptop just as easily as from a managed one.
The board asked for a zero trust plan and nobody knows which pillar to start with.
chapter 02 · what we change
How we solve it
Maturity assessment
Access policy design
VPN replacement with ZTNA
Crown-jewel segmentation
Device trust
Roadmap and funding case
chapter 03 · how it runs
Our approach
Baseline
Target and sequence
Pilot
Scale
chapter 04 · where you end up
What changes
The VPN profile gets smaller with every wave.
The committee now has a single plan with the current score, target stages and quarterly checkpoints.
Maturity scorecard by pillar
Target architecture and access policy model
what we do
Where we spend the hours
6 areas of work, each one done by an engineer who has run it in production.
We go pillar by pillar through CISA's Zero Trust Maturity Model 2.0, which grades identity, devices, networks, applications and workloads, and data on four stages from Traditional up to Optimal. You walk away knowing today's score and a target you can actually reach.
Policies that combine user risk, device compliance from Intune or your MDM, and app sensitivity. They're written once at the identity provider and enforced the same way for every app behind it.
We publish private apps through Microsoft Entra Private Access or another ZTNA service, beginning with a pilot group and a few web apps before tackling thick clients and legacy protocols.
The systems whose compromise would stop the business, like identity, backups and payments, get isolated first, behind explicit allow rules.
We set up certificate- or MDM-based device identity. Then the right password typed on an unmanaged laptop gets a different answer than it would on a managed one.
We write the sequence application by application, with effort, dependencies and license impact for each, in language a CFO can follow without a glossary.
capability 01 / 06in production
Maturity assessment
We go pillar by pillar through CISA's Zero Trust Maturity Model 2.0, which grades identity, devices, networks, applications and workloads, and data on four stages from Traditional up to Optimal. You walk away knowing today's score and a target you can actually reach.
Policies that combine user risk, device compliance from Intune or your MDM, and app sensitivity. They're written once at the identity provider and enforced the same way for every app behind it.
We publish private apps through Microsoft Entra Private Access or another ZTNA service, beginning with a pilot group and a few web apps before tackling thick clients and legacy protocols.
We set up certificate- or MDM-based device identity. Then the right password typed on an unmanaged laptop gets a different answer than it would on a managed one.
We write the sequence application by application, with effort, dependencies and license impact for each, in language a CFO can follow without a glossary.
We pieced these together from Zero Trust Architecture situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Entra Private Access licensed, and covering three web apps
composite · not a client story
Beforethe situation
Entra Suite licenses were bought a year ago. Three internal web apps are published through Private Access, while 2,000 users still run a full-tunnel VPN client to reach file shares, RDP hosts and a thick-client ERP.
What we dothe work
VPN logs tell us which private apps have the most users and the most sensitive data, and we rank them that way. File shares and RDP go out first through Private Access application segments for a pilot group, then the ERP client once its ports are mapped. With each wave, the matching routes come off the VPN profile.
Afterwhere you end up
The VPN profile gets smaller with every wave. Conditional Access decides access to each app from user and device signals, not network location.
case file 02
The audit committee asked for one zero trust plan and got three
composite · not a client story
Beforethe situation
A peer company got hit with ransomware, and the audit committee asked for a zero trust roadmap. Devices are split across Intune and an older MDM. Identity, network and endpoint teams have each written a draft.
What we dothe work
Score each CISA pillar from exported configuration, with interviews filling gaps. Agree a target stage per pillar with the CISO, then merge the three drafts into one app-by-app sequence, starting with phishing-resistant MFA and device compliance in Conditional Access.
Afterwhere you end up
The committee now has a single plan with the current score, target stages and quarterly checkpoints. Identity, network and endpoint teams work from the same sequence instead of three.
Each request is judged on who the user is, their risk and whether the device is compliant, then allowed to one application at a time through ZTNA. The legacy VPN keeps a shrinking scope until the last apps move.
how it runs
A typical engagement
We don't start a step until the last one has produced something you can check.
step 01
Baseline
Interviews and configuration review across identity, devices, network and key apps, scored against the CISA model.
step 02
Target and sequence
Target maturity agreed per pillar, then an app-by-app order based on risk and effort.
step 03
Pilot
One user group and a handful of apps move to policy-based access. We measure the support load and how much sign-in friction people actually feel.
step 04
Scale
We move the remaining apps in waves and cut back what the VPN can reach after each one.
you keep
What you're left with
We write these for your Zero Trust Architecture setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
00:0006:0012:0018:0000:00
certifications our engineers hold
Microsoft Certified: Cybersecurity Architect ExpertMicrosoft
Microsoft Certified: Identity and Access Administrator AssociateMicrosoft
roles we staff
Zero trust architect
IAM engineer (Conditional Access)
ZTNA network engineer
Endpoint security engineer
Cloud security engineer
due diligence · zero trust architecture
Questions to ask any partner, including us.
Put these to anyone bidding on your Zero Trust Architecture work. The ones who've done it answer differently from the ones who've read about it.
Q1
Interviews are one thing. How will you score our maturity from configuration evidence?
When teams report their own maturity, the number usually runs high. A score built from exported policies, device compliance data and network rules holds up when an auditor asks how it was reached.
Q2
Which of our apps can't move behind ZTNA, and what happens to them?
Thick clients, UDP-heavy protocols, OT systems and server-initiated connections are the usual holdouts. A plan with no named exception path stalls at the last wave.
Q3
What VPN decommissioning criteria will you hold us to?
Without agreed exit criteria the VPN never gets switched off. They should cover the users still on it, the apps still on it, and the fallback for remote incident response.
Q4
Contractors sign in from unmanaged laptops. How does device trust work for them?
Contractors often can't enroll in your MDM. That leaves browser-only access, virtual desktops or app-specific policies, and each changes cost and user experience.
Q5
Which licenses we already hold cover parts of the roadmap?
Entra ID P1 or P2, Intune and Entra Suite often cover Conditional Access, device compliance and ZTNA. The roadmap should mark where spend is new and where it isn't.
01Is zero trust a product we can buy?
No. Vendors sell pieces of it, such as identity providers, ZTNA, device management and segmentation tools. NIST SP 800-207 describes zero trust as a set of principles and an architecture. We help you decide which pieces you need and in what order, and often the first ones are licenses you already hold.
02Can we keep the VPN during the transition?
Yes, and you should. We shrink what the VPN can reach as apps move behind ZTNA, and switch it off once the remaining users and apps meet criteria we've agreed with you. Some legacy and OT systems may keep a tightly scoped VPN for quite a while.
03Which pillar should we start with?
Identity, in nearly every case. Phishing-resistant MFA and sound access policy remove the most risk per dollar, and every later pillar depends on knowing who is asking. Device trust usually comes next.
04How long does a zero trust program take?
Think quarters, in waves, rather than one big project. A pilot can be done in weeks. How long the VPN takes to retire depends on your legacy and non-web apps, so you get a sequence with checkpoints instead of a single end date.
05We've got service accounts and workloads too. Does zero trust cover them?
Yes. CISA's model has a pillar for applications and workloads. In practice that means workload identity federation instead of stored keys, and segmentation between services so one compromised workload can't reach the rest. Our non-human identities pages cover the credential side.
related
Often paired with
Projects on Zero Trust Architecture usually end up touching one of these, so they're worth a look.
