Zero Trust Starts After the Login

"We rolled out multifactor authentication two years ago. Are we zero trust?"

The question usually arrives in a tone that expects a yes. The honest answer is no, and it has nothing to do with whether MFA was a good decision. It was. MFA answers a question asked once, at the door. The rest of the workday happens after the door closes.

Zero trust is not a product, a purchase, or a project with a completion date. It is a design assumption: that no request earns trust from its origin, and that trust granted at sign-in expires. Plenty of organizations adopted the vocabulary during the remote-work scramble and never moved the architecture behind it. That gap is where the 2026 conversation actually lives.

The office IP address stopped being a security control

Los Angeles businesses run on geography that no 2016 security model anticipated. A sixty-person firm might keep a Woodland Hills office, a second suite downtown, a controller working from Pasadena three days a week, and a sales lead functionally mobile between Long Beach and client sites. The commute shapes the work pattern. That pattern decides where the data goes.

Many such companies still carry access rules written when the VPN was the trust boundary and "on the network" meant "verified." Those rules survive untouched: applications that trust any connection from the office subnet, file shares where presence implies permission, admin consoles reachable from anywhere inside the tunnel.

A VPN is still useful. It is transport, not a verdict. Once an attacker holds a valid credential or a hijacked session, the tunnel carries them in as politely as it carries your CFO. Treating network location as evidence of identity is, in our assessment, the most common unexamined assumption in hybrid-era IT security, and it rarely appears on a risk register because nobody remembers deciding it.

Authentication is a moment; access is a duration

Worth stating plainly, as analysis rather than alarm: when someone signs in, a session token is issued, and that token is what actually grants access for the hours or days that follow. Credential theft aimed at the token sidesteps the login prompt entirely. No password is required. The MFA challenge you are counting on is never presented, because the attacker arrives after it.

The defense is not more authentication. It is shorter, more conditional trust. In practice that means a small set of decisions many Microsoft 365 tenants can already make and simply have not:

• Device posture as a condition. Access requires a managed, compliant, encrypted device, not merely a correct password from an unknown laptop.
• Phishing-resistant authentication where it matters most. Passkeys and hardware-bound credentials cannot be relayed through a proxy the way a one-time code can.
• Session lifetime matched to risk. A finance approval session should not persist as long as a lobby display login.
• Continuous evaluation. When risk signals change mid-session, the session is re-challenged rather than honored until expiry.
• Legacy authentication disabled. Protocols that cannot carry a second factor are the back door that invalidates the front one.

Which of these are available to you depends on your licensing tier, and confirming what your tenant already includes is a short exercise rather than a procurement cycle. The obstacle is rarely technical. More often, nobody owns the decision.

Most of your new identities cannot receive a push notification

Here is the part that changes the math for 2026. The population of things signing into your systems is no longer mostly human.

Service accounts, API keys, third-party integrations, OAuth-connected SaaS tools, automation scripts, and now AI agents all authenticate. None of them can approve a prompt on a phone. Many were created by a well-meaning employee who clicked accept on an app consent screen and handed a vendor standing read access to a mailbox. Identities like these commonly have no rotation schedule, no expiry, no owner listed anywhere, and permissions chosen for convenience during setup.

AI assistants make the problem visible in an uncomfortable way. Copilot-style tools are designed to answer within the permissions the requesting user already holds. That is correct behavior. It also means years of over-permissioned SharePoint sites and share-with-everyone folders become searchable in plain English. The tool did not create the exposure; it surfaced it. An executive who asks an assistant what it knows about compensation planning and gets a real answer has just received an unplanned access audit.

Zero trust applied to machine identities means something specific: every non-human account has a named owner, a defined scope, an expiry date, and a log someone actually reads. That is governance work, not a purchase. It belongs in the same conversation as data backup, because modern extortion involves stolen data as well as encrypted data, and exfiltration travels on credentials that look entirely legitimate.

Exceptions granted at 9 p.m. become your real architecture

Every zero trust deployment creates friction at the worst possible moments. A partner cannot reach a document the night before a filing. A device falls out of compliance the morning of a board meeting. Someone traveling hits a conditional access block from a hotel in another time zone.

What happens next decides whether the design survives. If help is slow, a person with authority says turn it off for me, and that exception becomes permanent. Accumulate enough of them and the policy exists on paper while the real access model is whatever was fastest at 9 p.m. Stated as opinion rather than finding: more good security designs die this way than are defeated technically.

Support capacity, then, is a security control rather than a convenience line item. At Pro Link Systems, the help desk is in-house, US-based and staffed 24/7, with an average ticket first-response time of 15 minutes and phones answered live by that same team. The relevance is unglamorous: a user who reaches a real person quickly does not need an exception, and an exception never granted is an attack path that never opens.

The question to put to your technology team

"Are we zero trust?" has no useful answer. It asks for a yes or no about something that is neither.

Better, and specific enough to hold a team to: for each class of access we grant, what conditions must be true, and when does that trust expire? If the answer for your financial systems is a correct password, from anywhere, for as long as the browser stays open, you now know your real posture regardless of what the strategy deck says.

Ask it about employees. Then ask about contractors, the marketing SaaS tool connected to your tenant, the automation someone built last spring, the assistant that reads executive email. Answers will not be uniform across those, and they should not be. They should be deliberate.

Pro Link Systems has supported Los Angeles businesses from Woodland Hills since 1999, and the hybrid shift changed far more about identity than it changed about networks. If you want a clear read on where trust is currently being granted by default across your environment, our managed IT services team will walk that assessment with you.