Security services · Architecture

Zero trust architecture.

“Inside the office network” no longer means “safe”. Zero trust checks every user, device and request, every time, wherever it comes from. We assess where you are, design where you need to be, and help you get there in phases that do not stop the business.

Get a fixed-price quote
Based on NIST SP 800-207Phased, not big-bangVendor-neutral
zero trust · sample● demo
  1. BLOCKED Stolen password: strong MFA challenge failed
  2. BLOCKED Unpatched personal laptop denied finance app
  3. PASSED Contractor sees one app, not the network
  4. FLAGGED Admin rights granted for one hour only
  5. FIXED VPN retired for 120 staff
In plain words

Zero trust is a security approach that never assumes a user or device is safe just because it is on your network. Every request to an app or to data is checked: who the person is, whether their device is healthy and whether the request makes sense, and access is limited to exactly what is needed. We turn the principles of NIST SP 800-207 and the CISA Zero Trust Maturity Model into a practical, phased roadmap for your organisation.

Duration
4–12 weeks
Model
NIST SP 800-207 · CISA ZTMM 2.0
Approach
Phased roadmap
Pricing
Fixed fee
The idea in one picture

Castle and moat vs. zero trust.

Castle and moat

Hard outside, soft inside.

  • Anyone inside the network is trusted
  • One stolen VPN password opens the gates
  • Contractors often get far more access than they need
  • Home and cloud working break the model
  • Simple to understand

Zero trust

Never trust, always verify.

  • Every request checked: user, device and context
  • Access limited to the apps each person needs
  • Stolen passwords stopped by strong MFA and device checks
  • Works the same in the office, at home and in the cloud
  • Attackers who get in cannot roam freely
Where you are, where you are going

Five pillars, four steps of maturity.

CISA’s Zero Trust Maturity Model scores five pillars from Traditional to Optimal. We score yours, agree a realistic target and plan the steps in between.

Sample zero trust maturity scorecard across five pillars: identity, devices, networks, applications and data, each scored Traditional, Initial, Advanced or Optimal. Today identity and applications are at Initial and the others at Traditional; the 12-month targets are Advanced for identity, devices and applications, and Initial for networks and data. IDENTITYDEVICESNETWORKSAPPLICATIONSDATAOPTIMALADVANCEDTARGETTARGETTARGETINITIALTODAYTARGETTODAYTARGETTRADITIONALTODAYTODAYTODAYACROSS ALL: VISIBILITY · AUTOMATION · GOVERNANCE
Sample scorecard, not client data. Pillars and stages from CISA’s Zero Trust Maturity Model 2.0 (2023); architecture principles from NIST SP 800-207 (2020).
What we design

The building blocks of zero trust.

  • Identity and MFA

    Single sign-on, phishing-resistant MFA and conditional access.

  • Privileged access

    Admin rights granted just in time, and passwords kept in a vault.

  • Device trust

    Only managed, patched and encrypted devices reach sensitive apps.

  • Micro-segmentation

    Servers and workloads that only talk to what they must.

  • Secure access (ZTNA, SASE)

    App-by-app access that reduces or replaces the VPN.

  • Data protection

    Sensitive data labelled, and sharing and downloads controlled.

  • Applications

    Access decided per app and per session, not per network.

  • Monitoring

    Sign-in and device signals feed the SOC, and risky sessions are cut.

  • AI agents and service accounts

    Non-human identities given the least access they need, and watched.

How it works

Assess, design, then move in phases.

  1. Weeks 1–2

    Maturity assessment

    Score each pillar with workshops, configuration reviews and interviews.

  2. Weeks 2–5

    Architecture

    Target design, policies and the tools that fit what you already own.

  3. Weeks 5–8

    Pilot

    One group of users and apps, to prove it works and learn.

  4. In phases

    Rollout

    Group by group, highest risk first, with your team or ours.

  5. Every quarter

    Measure

    Re-score the pillars and adjust the roadmap.

What you get

A roadmap you can actually follow.

HANULSECZero trust maturity assessment CLIENTSample · 1,200-person IT services firm SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical1High4Medium6Low3 PILLARS · IDENTITY · DEVICES · NETWORK · APPS · DATA ROADMAP AGREED Sample layout, not client data
  • 01
    Maturity scorecard

    Where each pillar stands today, against the CISA model.

  • 02
    Target architecture

    How identity, devices, network, apps and data will work together.

  • 03
    Phased migration roadmap

    Steps in order, with effort, cost drivers and risk reduction for each.

  • 04
    Vendor selection support

    Requirements, shortlists and proof-of-concept plans, without vendor bias.

  • 05
    Pilot runbook

    How to switch the first group over safely.

Who it is for

For organisations that outgrew the office network.

  • Companies with remote and hybrid staff
  • Firms that rely on a VPN for everything
  • Organisations with many contractors and partners
  • Businesses moving most apps to the cloud and SaaS
  • Teams whose auditors or customers ask about least privilege

Start with identity

Most organisations get the biggest early gain from single sign-on and strong, phishing-resistant MFA. It is usually the first phase of our roadmaps.

Frameworks

Grounded in public frameworks.

NIST SP 800-207Zero trust architecture
NIST CSF 2.0Govern to recover
CIS BenchmarksSecure configuration
ISO/IEC 27001Information security

Emblems are HanulSec’s own artwork showing which frameworks our work maps to. They are not the owners’ logos and do not mean HanulSec is certified against them.

Questions

Questions buyers ask before they call us.

Q01What is zero trust, in simple terms?
Zero trust means no user or device is trusted just because it is inside your network. Every request is checked, using who the person is, the health of their device and the context, and people get access only to what they need.
Q02Is zero trust a product we can buy?
No. It is an approach. Identity providers, device management and secure access services (ZTNA or SASE) help, but zero trust comes from how they are designed and configured together. Be wary of any single product sold as zero trust in a box.
Q03Do we have to replace our VPN?
Not on day one. Many organisations keep the VPN for a while and move app by app to zero trust network access, retiring the VPN once the last group has moved.
Q04How long does zero trust take?
The assessment and roadmap take 4 to 12 weeks. The rollout usually happens in phases over one to three years, with the biggest risk reductions, such as strong MFA, in the first months.
Q05Which frameworks do you use?
NIST SP 800-207 (2020) defines zero trust architecture. CISA’s Zero Trust Maturity Model 2.0 (2023) measures progress across five pillars: identity, devices, networks, applications and workloads, and data.
Q06How is it priced?
A fixed fee for the assessment and roadmap. Rollout support is priced as a project or monthly.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings