Security · Technology · 7 months
Zero-Trust Network Rollout
Nine hundred engineers shared one VPN and implicit trust. We replaced it with identity-aware proxies, short-lived certificates and per-service policy — phishing-resistant logins everywhere, and the VPN concentrators finally retired.
-
Identity becomes the perimeter
Phishing-resistant logins and short-lived certificates replaced shared network trust — every request carries who, what and why.
-
Policy per service
Envoy sidecars enforce SPIFFE-identified policy at each of 300 services. Flat-network lateral movement simply stops existing.
-
Retire the VPN loudly
Teams migrated in waves with a countdown dashboard. The concentrators were unplugged on a Friday — celebrated, not mourned.
Trust nothing on the network. Verify everything at the identity.
900engineers migrated
300services protected
0VPN appliances left
- BeyondCorp-style IAP
- Okta
- Envoy
- SPIFFE
Still VPN-ing into production?
There's a safer topology — let's map your path off the concentrators.
Start a project