Retire the VPN one application at a time. Start with the ones attackers want most.
A flat VPN gives a contractor's laptop the same reach as a domain controller. We score where you stand on the CISA Zero Trust Maturity Model. Then we move access to identity- and device-aware policy, one app at a time, using Microsoft Entra Private Access or the ZTNA service you already own.
ZTNA serviceEntra Private Access or similarLegacy VPNshrinking scope
04 · Private resources
Private web appsintranet · admin consolesCrown-jewel systemsidentity · backups · paymentsLegacy and OT systemsthick clients · old protocols
Microsoft Entra IDOktaPing IdentityTerraform
in short·20-second read
Zero trust architecture means nothing is trusted by default, whether it's a user, a device or a network location.
Every request is checked against identity, device health and context. Cohash turns that into a sequenced plan. We assess maturity against CISA's model and design access policy. Then we replace VPN access with zero trust network access one app at a time and segment the systems that matter most. Most of the work is identity, which is our core practice.
you probably need this if
A contractor on the VPN can reach the same subnets as your domain controllers.
The same password works the same way from a personal laptop and a managed one.
The board asked for a zero trust plan and nobody knows which pillar to start with.
terms on this pageZero trustdefinitionA security model where nothing is trusted just because of where it sits. Every request gets checked against current evidence about the user, the device and the context.explained in a field note →
Zero trust architectIAM engineer (Conditional Access)ZTNA network engineer
Microsoft Certified: Cybersecurity Architect Expert
Microsoft Certified: Identity and Access Administrator Associate
From the first call to a setup your own team can run.
Here's what usually prompts a call about your Zero Trust Architecture, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · zero trust architecture3 open
openA contractor on the VPN can reach the same subnets as your domain controllers.
recurringThe same password works the same way from a personal laptop and a managed one.
blockedThe board asked for a zero trust plan and nobody knows which pillar to start with.
exposure
Maturity assessmentAccess policy designVPN replacement with ZTNACrown-jewel segmentationDevice trustRoadmap and funding case
startrehearsehandover
Baseline
Target and sequence
Pilot
Scale
we are here
ready to hand over
The VPN profile gets smaller with every wave.
There's one plan in front of the committee now.
Maturity scorecard by pillar
Target architecture and access policy model
chapter 01 · where it hurts
Why teams reach out
A contractor on the VPN can reach the same subnets as your domain controllers.
The same password works the same way from a personal laptop and a managed one.
The board asked for a zero trust plan and nobody knows which pillar to start with.
chapter 02 · what we change
How we solve it
Maturity assessment
Access policy design
VPN replacement with ZTNA
Crown-jewel segmentation
Device trust
Roadmap and funding case
chapter 03 · how it runs
Our approach
Baseline
Target and sequence
Pilot
Scale
chapter 04 · where you end up
What changes
The VPN profile gets smaller with every wave.
There's one plan in front of the committee now.
Maturity scorecard by pillar
Target architecture and access policy model
what we do
Where we spend the hours
6 areas of work, each one done by an engineer who has run it in production.
A review of each pillar in CISA's Zero Trust Maturity Model 2.0. The model scores identity, devices, networks, applications and workloads, and data on four stages, from Traditional up to Optimal. You leave with today's score and a target you can actually reach.
Policies that combine user risk, device compliance from Intune or your MDM, and app sensitivity. They're written once at the identity provider and enforced the same way for every app behind it.
We publish private apps through Microsoft Entra Private Access or another ZTNA service, beginning with a pilot group and a few web apps before tackling thick clients and legacy protocols.
The systems whose compromise would stop the business, like identity, backups and payments, get isolated first, behind explicit allow rules.
We set up certificate- or MDM-based device identity. Then the right password typed on an unmanaged laptop gets a different answer than it would on a managed one.
We write the sequence application by application, with effort, dependencies and license impact for each, in language a CFO can follow without a glossary.
capability 01 / 06in production
Maturity assessment
A review of each pillar in CISA's Zero Trust Maturity Model 2.0. The model scores identity, devices, networks, applications and workloads, and data on four stages, from Traditional up to Optimal. You leave with today's score and a target you can actually reach.
Policies that combine user risk, device compliance from Intune or your MDM, and app sensitivity. They're written once at the identity provider and enforced the same way for every app behind it.
We publish private apps through Microsoft Entra Private Access or another ZTNA service, beginning with a pilot group and a few web apps before tackling thick clients and legacy protocols.
We set up certificate- or MDM-based device identity. Then the right password typed on an unmanaged laptop gets a different answer than it would on a managed one.
We write the sequence application by application, with effort, dependencies and license impact for each, in language a CFO can follow without a glossary.
We pieced these together from Zero Trust Architecture situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Entra Private Access licensed, and covering three web apps
composite · not a client story
Beforethe situation
Entra Suite licenses were bought a year ago. Three internal web apps are published through Private Access, while 2,000 users still run a full-tunnel VPN client to reach file shares, RDP hosts and a thick-client ERP.
What we dothe work
VPN logs tell us which private apps have the most users and the most sensitive data, and we rank them that way. File shares and RDP go out first through Private Access application segments for a pilot group, then the ERP client once its ports are mapped. With each wave, the matching routes come off the VPN profile.
Afterwhere you end up
The VPN profile gets smaller with every wave. Conditional Access decides access to each app from user and device signals, not network location.
case file 02
An audit committee wants a zero trust plan, and three teams wrote one each
composite · not a client story
Beforethe situation
A peer company got hit with ransomware, and the audit committee asked for a zero trust roadmap. Devices are split across Intune and an older MDM. Identity, network and endpoint teams have each written a draft.
What we dothe work
Score each CISA pillar from exported configuration, with interviews filling gaps. Agree a target stage per pillar with the CISO, then merge the three drafts into one app-by-app sequence, starting with phishing-resistant MFA and device compliance in Conditional Access.
Afterwhere you end up
There's one plan in front of the committee now. It has the current score, the target stages and quarterly checkpoints, and the three teams all follow the same sequence.
Each request is judged on who the user is, their risk and whether the device is compliant, then allowed to one application at a time through ZTNA. The legacy VPN keeps a shrinking scope until the last apps move.
01 · Users and devices
Employees and contractorsphishing-resistant MFA → Identity provider · sign-in→ Legacy VPN · legacy apps only
Identity providerEntra ID · Okta → Access policy · identity and risk
Access policyuser risk · device · app tier → ZTNA service · allow per app
03 · Access path
ZTNA serviceEntra Private Access or similar → Private web apps · app tunnel→ Crown-jewel systems · explicit allow
Legacy VPNshrinking scope → Legacy and OT systems · narrow scope
04 · Private resources
Private web appsintranet · admin consoles
Crown-jewel systemsidentity · backups · payments
Legacy and OT systemsthick clients · old protocols
Read the diagram as text
Employees and contractors → Identity provider: sign-in
Managed device → Access policy: compliance signal
Identity provider → Access policy: identity and risk
Access policy → ZTNA service: allow per app
ZTNA service → Private web apps: app tunnel
ZTNA service → Crown-jewel systems: explicit allow
Employees and contractors → Legacy VPN: legacy apps only
Legacy VPN → Legacy and OT systems: narrow scope
how it runs
A typical engagement
We don't start a step until the last one has produced something you can check.
step 01
Baseline
Interviews and configuration review across identity, devices, network and key apps, scored against the CISA model.
step 02
Target and sequence
Target maturity agreed per pillar, then an app-by-app order based on risk and effort.
step 03
Pilot
One user group and a handful of apps move to policy-based access. We measure the support load and how much sign-in friction people actually feel.
step 04
Scale
Remaining apps migrated in waves, and VPN reach reduced as each wave lands.
you keep
What you're left with
We write these for your Zero Trust Architecture setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Put these to anyone bidding on your Zero Trust Architecture work. The ones who've done it answer differently from the ones who've read about it.
Q1
Interviews are one thing. How will you score our maturity from configuration evidence?
When teams report their own maturity, the number usually runs high. A score built from exported policies, device compliance data and network rules holds up when an auditor asks how it was reached.
Q2
Which of our apps can't move behind ZTNA, and what happens to them?
Thick clients, UDP-heavy protocols, OT systems and server-initiated connections are the usual holdouts. A plan with no named exception path stalls at the last wave.
Q3
What VPN decommissioning criteria will you hold us to?
Without agreed exit criteria the VPN never gets switched off. They should cover the users still on it, the apps still on it, and the fallback for remote incident response.
Q4
How does device trust work for contractors on unmanaged laptops?
Contractors often can't enroll in your MDM. That leaves browser-only access, virtual desktops or app-specific policies, and each changes cost and user experience.
Q5
Which licenses we already hold cover parts of the roadmap?
Entra ID P1 or P2, Intune and Entra Suite often cover Conditional Access, device compliance and ZTNA. The roadmap should mark where spend is new and where it isn't.
01Is zero trust a product we can buy?
No. Vendors sell pieces of it, such as identity providers, ZTNA, device management and segmentation tools. NIST SP 800-207 describes zero trust as a set of principles and an architecture. We help you decide which pieces you need and in what order, and often the first ones are licenses you already hold.
02Can we keep the VPN during the transition?
Yes, and you should. We shrink what the VPN can reach as apps move behind ZTNA, and switch it off once the remaining users and apps meet criteria we've agreed with you. Some legacy and OT systems may keep a tightly scoped VPN for quite a while.
03Which pillar should we start with?
Identity, in nearly every case. Phishing-resistant MFA and sound access policy remove the most risk per dollar, and every later pillar depends on knowing who is asking. Device trust usually comes next.
04How long does a zero trust program take?
Think quarters, in waves, rather than one big project. A pilot can be done in weeks. How long the VPN takes to retire depends on your legacy and non-web apps, so you get a sequence with checkpoints instead of a single end date.
05Does zero trust apply to service accounts and workloads?
Yes. CISA's model has a pillar for applications and workloads. In practice that means workload identity federation instead of stored keys, and segmentation between services so one compromised workload can't reach the rest. Our non-human identities pages cover the credential side.
related
Often paired with
Projects on Zero Trust Architecture usually end up touching one of these, so they're worth a look.
