Security · 2026-04-15 · 10 min
Zero trust for growing SaaS: identity, secrets, and least privilege
You do not need a 200-person security org to stop the common breach path. Start with identity, secrets, and blast-radius limits that a 12-person team can actually run.
Verizon’s DBIR continues to show stolen credentials and phishing as dominant initial access. For a SaaS company, that usually means a reused password on a cloud console, a leaked GitHub token, or an over-privileged IAM role.
Minimum viable zero trust
NIST SP 800-207 is the vocabulary. Your implementation can be boring: Okta or Entra, AWS IAM Identity Center, GitHub OIDC, and a secrets manager.
- SSO + hardware or app MFA on every console, including DNS and billing.
- Short-lived credentials. No long-lived access keys in CI.
- Network policies so a compromised pod cannot scan the entire VPC.
- Audit logs shipped somewhere an attacker cannot quietly delete.
What to postpone
A six-month CASB evaluation while production still has a shared admin password is theatre. Fix the shared password this week. Buy the platform next quarter if you still need it.