For most small companies, the first real encounter with zero trust arrives as a document. A security questionnaire from a customer’s procurement team, a renewal form from an insurance broker, an auditor asking for evidence. Somewhere in it sits a question about which employees can reach which systems, and whether anyone can prove it. A company with 80 people and one and a half IT staff is now expected to have an answer, on a schedule nobody in the building chose.
For most of the past decade, zero trust was an enterprise conversation, priced and marketed for a buyer with a dedicated security team. Smaller companies were told the model made sense in principle and was built for someone else. Three forces are dismantling that assumption at once: compliance regimes arriving on schedules of their own, insurers who now audit controls instead of accepting attestations, and AI tools creating a class of accounts nobody is governing.
Does Zero Trust Make Sense for a Small Business?
For a growing share of them, yes, though the reasoning has changed. The old argument rested on threat modeling, which a 60-person company could comfortably defer. The argument now rests on evidence, because the people asking are auditors, underwriters, and enterprise customers running vendor due diligence.
The working definition is narrower than the marketing suggests. No user, device, or application earns trust from its position on the network. Every request gets checked against identity and context first, and the grant covers only the resource the role requires.
The second half of the answer is that the tooling has caught up. Zero trust at this scale no longer demands the platform a bank would buy, or a security team to run it. Zero Trust Network Access now arrives as a cloud service, and CloudConnexa from OpenVPN is one example, built for SMBs whose entire IT function is a couple of people.
1. Which Compliance Deadlines Reach a Small Company in 2026
Much of the current coverage frames 2026 as the year three regulations arrive. The real picture splits three ways.
Already in force. PCI DSS v4.0’s future-dated requirements became mandatory in March 2025, all 51 of them, with no grace period. In Europe, DORA has applied to financial firms since January 2025 and NIS2 has been switching on unevenly across member states since its 2024 deadline. None of these are coming. They arrived, and they reach companies well below enterprise scale, including any business that takes card payments or supplies a regulated bank.
Landing this year, aimed at smaller firms by design. The SEC’s amended Regulation S-P reached larger firms in December 2025 and smaller ones on 3 June 2026. The stagger was written into the rule, which tells you who regulators had in mind. Smaller broker-dealers and advisers now need a written incident response plan, breach notification, documented oversight of their vendors, and records proving all of it.
And the two that buckled. On 13 July 2026, the Pentagon suspended CMMC Phase II, the rule that would have required defense contractors handling sensitive government data to pass a third-party security assessment from November. The announcement cited compliance costs, pointing to Small Business Administration findings that they were forcing companies out of the defense supply chain. A reform task force reports back in mid-September.
The requirements themselves stayed put. Contractors still have to meet the federal standard, NIST 800-171, and self-assess against it, and large primes still push the same obligations down to their subcontractors.
The proposed HIPAA Security Rule update tells a similar story. It would make multi-factor authentication and network segmentation mandatory instead of merely “addressable,” and it remains proposed. The finalization target passed without a rule, after more than 4,700 comments and provider groups arguing the requirements were unworkable for small and rural practices.
Both point the same way. Regulators have decided these controls are necessary, and they keep colliding with tooling that was priced and staffed for large organizations. The requirement is not going away, which leaves the delivery model as the thing that has to change.
What every one of these frameworks asks for:
- Verified identity on every access request
- Access limited to what a role genuinely requires
- Device health evaluated before entry
- An auditable record of who reached what and when
None of them require a product called zero trust. They describe its controls, then ask you to prove those controls are live.
2. Cyber Insurance Has Become a Controls Audit
Underwriting applies pressure sooner than any regulator does, because renewal comes around every year whether or not anyone is inspecting you. Questionnaires that once asked whether a firewall existed now ask harder things:
- Is access segmented, or can any authenticated user reach most of the network
- Is MFA enforced everywhere it counts, including remote access and admin accounts
- Could a single compromised laptop reach the systems that matter
- Can you produce evidence for each of those answers
The last one is where small companies come apart.
The City of Hamilton, Ontario shows what happens when the answer is close but incomplete. Ransomware disabled roughly 80% of the city’s network in February 2024. In July 2025, councillors learned the insurer had denied a claim of roughly C$5 million, because the policy excluded losses where the absence of multi-factor authentication was the root cause. MFA had reached only a handful of departments. Staff had known about the requirement since the fall of 2022 and were preparing full deployment when the attack landed. Recovery costs have run to about C$18.3 million.
Underwriting extends no credit for partial deployment. A control that covered one department and missed four others fails the same way a missing control does. For smaller companies the practical consequence is that underwriting math forces the upgrade long before any internal risk assessment does.
It also raises the value of the least glamorous control in the set. Segmentation and MFA can be described on a form. Access logs are what let an underwriter check the description against the record, which is why ZTNA services like CloudConnexa from OpenVPN ship logging alongside enforcement.
3. Nobody Is Governing the AI Agents
Here is the part most zero trust coverage has yet to catch up with. Small businesses have adopted AI copilots and agents at speed, and every one of those tools is an identity. An assistant indexed against company documents, a bot querying an internal database, an automation moving records between SaaS platforms: each has standing reach into systems, and most were given broad permissions so they would work on the first attempt.
The grant is invisible, it appears on no org chart, and nobody revokes it when a pilot turns into production. A machine identity deserves the treatment a contractor gets: specific access, time bounded where possible, and logged.
Vendors have started building at this layer. In December 2025, OpenVPN announced a partnership with iVALT to bring passwordless, human-bound PKI authentication to its business products, tying each login to a verified individual through device binding and biometric factors. The companies framed part of the rationale around AI, specifically ensuring that a validated human is what triggers action across access and AI-driven systems.
The Gap Between Enterprise Tooling and a Two-Person IT Team
Most zero trust products were built for a buyer profile that no longer describes the whole market. Platforms from Zscaler, Palo Alto Networks, and Cisco’s Duo target large security organizations, with pricing and integration surface that assume staffing to match. A 90-person manufacturer needs the controls a Fortune 500 needs. What it cannot absorb is a deployment measured in quarters.
That gap has opened room for vendors positioning ZTNA at the SMB and midmarket buyer, and it has also created noise. Tailscale, Twingate, and NordLayer have made secure connectivity dramatically easier for small teams, and each has built toward access control. Point-to-point connectivity solves reachability. ZTNA governs what a connected identity is permitted to touch.
Buyers comparing options should get specific about enforcement: whether device health is evaluated continuously or checked once at connection, whether least-privilege segmentation happens at the application level or the network level, and whether policy is applied per session. Those answers vary across products and across pricing tiers of the same product, and they are what an auditor or underwriter asks about.
OpenVPN occupies an unusual position in that comparison. Its open-source protocol has been the transport layer for a large share of the VPN market for two decades, so its reach already sits inside most infrastructure. The company’s move has been to build zero trust enforcement on that footprint and size it for the teams enterprise platforms priced out.
What Right-Sized ZTNA Looks Like
CloudConnexa from OpenVPN is what that footprint turns into for a smaller buyer. It is cloud-delivered Zero Trust Network Access, which removes the infrastructure step that stalls most small-team rollouts, and it is sized for a company with one or two IT administrators instead of a staffed security operations center. More than 20,000 organizations use OpenVPN’s products. CloudConnexa applies identity, device, and location context to access policy, with least-privilege enforcement doing the work:
- Device posture: continuous evaluation of device security against multiple parameters
- Micro-segmentation: applications isolated behind precise access rules, so a verified user reaches only what the role permits
- Concealment: routes to connected networks stay hidden, limiting what an attacker can enumerate
- Access and DNS logging, with log streaming into external security tools
For a two-person IT function the practical difference is the sequence. There is no appliance to size and no cluster to keep patched. Access groups are defined once against roles, device requirements sit alongside them, and the same policy follows the user whether they are in the office, at home, or on a customer’s network. The controls that a compliance framework and an insurance questionnaire both ask about end up configured in the same place, which is the difference between a control a small team can prove and one it keeps meaning to finish.
CloudConnexa is SOC 2 Type 2 audited and ISO/IEC 27001:2022 certified, and OpenVPN documents it as HIPAA and GDPR compliant, which answers several questions on a customer’s vendor form outright.
What Zero Trust Should Cost a 50-to-200 Person Company
When a deadline lands, the instinct is to buy the most complete platform available, which usually means paying for an enterprise security team’s toolkit: threat-hunting consoles, deep SIEM integrations, and administrative depth built for analysts who do this work full time. Buying that far past the four controls listed above leaves a small business paying for security it cannot operate, which becomes its own exposure the moment someone asks for evidence.
The delivery model matters as much as the price. OpenVPN publishes a CloudConnexa quick-start guide of under 20 minutes and offers a free tier covering up to five seats, enough for a lean team to enforce real policy against one real application and find out what breaks before any budget moves. For a company that has just been handed a deadline, testing enforcement in an afternoon beats a feature list it will never reach the bottom of.
Final Thoughts
The shift underway in 2026 has less to do with any single product than with who now counts as a buyer. Regulation, underwriting, and AI adoption have pulled smaller companies into expectations built for enterprises, and the regulators themselves are now conceding that enterprise-scale delivery does not survive contact with a small company. The advantage belongs to whoever can deliver enforcement a two-person team can keep running.
The test for any small business in scope is short. If a customer, an auditor, or an underwriter asked tomorrow which systems each employee can reach, then asked to see the evidence, how long would it take to answer? For most companies, that question has stopped being hypothetical.
