Zero-trust rollout for a government agency

The client is a UK government agency of around 25,000 civil servants running on a flat internal network. As a public body handling sensitive systems, it is a high-value target and accountable for protecting them.

The flat network meant one compromised device could reach almost anything, but re-architecting access at that scale risked disrupting essential public services.

A flat internal network meant one compromised device could reach almost anything on sensitive systems: exactly the lateral movement modern attacks depend on. The architecture itself was the vulnerability.

Re-architecting access for 25,000 civil servants risked disrupting essential public services if handled clumsily. The scale and the stakes left little room for a misstep.

The agency needed to raise the security floor without a productivity hit or a big-bang cutover that could fail loudly. Security had to improve without services suffering.

We introduced device- and identity-aware access in phases, starting with the most sensitive systems where the risk reduction was greatest. Sequencing by risk means the biggest security gains land first.

Each phase was aligned to NCSC guidance and rolled out to a cohort first, so issues surfaced small and were fixed before the next wave. A phased, cohort-based rollout is what kept disruption contained.

Access decisions moved from network location to verified identity and device posture, and we instrumented productivity and support metrics throughout to catch friction early rather than after complaints. The floor rose without the services faltering.