Zero-Trust Cloud Setups for Teams Under 100 People

A right-sized security architecture: SSO, least-privilege IAM and encrypted-by-default storage.

Zero-trust marketing is aimed at enterprises with dedicated security teams. The underlying principles scale down well; the tooling usually does not.

For a team under 100, the highest-leverage move is single sign-on across everything, with no exceptions for the tool someone likes better. Identity is the control plane, and a single unfederated account undermines the entire model.

Least privilege is best implemented as short-lived, role-assumed credentials rather than long-lived keys attached to humans. This is less about sophistication and more about blast radius: a leaked credential that expires in an hour is an incident, not a breach.

Encryption at rest and in transit should be a default of the platform, not a checkbox someone remembers. If it is possible to provision an unencrypted bucket, someone eventually will.

Skip the network micro-segmentation projects at this size. The return is poor relative to identity hygiene, and the operational burden is real. Get identity, credentials and encryption right first — they cover the overwhelming majority of realistic threats.