Zero Trust for a Five-Person Startup vs a 5,000-Person Enterprise

Most zero-trust guidance is written for organisations with a dedicated security team, a service mesh, and a budget line for identity infrastructure. A five-person startup reading it reasonably concludes zero trust is not for them yet. That conclusion is wrong — the principles scale down; only the tooling changes.

Here is what 'verify explicitly, use least privilege, assume breach' actually looks like at a handful of very different company sizes.