Zero Trust Transformation at Scale: A Swiss Critical Infrastructure Success Story

A major Swiss critical infrastructure organization had everything — and nothing.

40,000+ endpoints. 70,000+ employees. 999,999+ private customers. 100+ subsidiaries across 3,500+ campus locations. Two public clouds, two on-premises datacenters. 100+ SaaS applications. Decades of security investments. No shortage of products.

The problem: none of it worked together.

The Scale

---

• 40,000+ endpoints across the organization
• 70,000+ employees operating across multiple business units
• 999,999+ private customers depending on services
• 3,500+ campus locations throughout Switzerland and internationally
• 100+ subsidiaries with varying security maturity
• Hybrid multicloud spanning 2 public clouds and 2 on-premises datacenters
• 100+ SaaS applications
• Decades of legacy IT systems
• Extensive IoT and OT infrastructure

The Challenge

---

Zero Trust doesn’t fail within components — it fails between them. And this organization had gaps everywhere.

The complexity had grown organically over decades. Each new threat prompted a new product. Each new product created new integration challenges. The security team was managing tools, not managing security.

• Multiple identity systems with inconsistent policies across subsidiaries
• Network segmentation reflecting historical org charts, not security requirements
• Endpoint agents that didn’t share data with the SIEM
• A SIEM that couldn’t see cloud workloads
• Limited visibility into lateral movement across hybrid multicloud environments
• Legacy systems that couldn’t simply be replaced or modernized overnight
• Critical infrastructure classification bringing regulatory scrutiny from FINMA and other authorities
• Complex compliance requirements including nFADP and GDPR for cross-border operations

The organization needed more than incremental improvement. It needed a fundamental transformation — not more products, but integration of what they had. And this transformation had to occur without disrupting operations that millions of Swiss citizens and businesses depend on daily.

The Approach

---

The transformation was structured as a multi-year program rather than a point project. This reflected the reality that genuine Zero Trust transformation cannot be achieved in a quarter or even a year.

Phase 1: Vision and Business Case

The program began with executive alignment on Zero Trust vision and principles. This was not a technical exercise but a business conversation: what security outcomes did the organization need to achieve, and how did Zero Trust principles support those outcomes?

Securing approval required navigating an incredibly complex organizational structure with a large, rigid middle management layer. The business case was presented to the IT Management Board, then escalated to the Executive Board, and finally to the Board of Directors. This phase produced a funded, board-approved 3-phase transformation program with a 4-year roadmap.

Phase 2: Architecture Design

With executive alignment secured, detailed architecture design commenced across all Zero Trust pillars. This was not a theoretical framework mapping but a practical design exercise:

• How would identity and access management work across the diverse environment?
• How would network segmentation be implemented without disrupting application dependencies?
• How would legacy systems that could not participate in modern protocols be accommodated?

The architecture explicitly addressed integration requirements, migration paths, and coexistence approaches. It was designed to be implemented incrementally, delivering value at each stage.

Phase 3: Phased Implementation

Implementation proceeded in waves, prioritizing high-risk areas while building foundational capabilities:

• Identity consolidation and enhancement
• Device trust establishment
• Network segmentation implementation

Critical to success was maintaining operational continuity. Every change was designed with rollback capability. Extensive testing preceded production deployment.

Phase 4: Operational Integration

Technology deployment alone does not achieve Zero Trust outcomes. The program included significant investment in:

• Updated security operations processes
• Enhanced monitoring and alerting
• Incident response procedure updates
• Training across technical teams

The Results

---

Risk Reduction

• 85% reduction in lateral movement risk through microsegmentation and enhanced network controls
• Dramatic reduction in identity-based attack surface through conditional access and continuous verification

Regulatory Compliance

• Full alignment with FINMA requirements for operational risk and IT security
• Compliant data protection practices supporting nFADP and GDPR requirements for cross-border operations
• 6 months to achieve regulatory compliance from program initiation

Operational Efficiency

• Improved visibility enabling faster threat detection and response
• Reduced alert volumes through better signal quality
• Security teams able to focus on genuine threats rather than false positives

Foundation for Future

• AI integration capability for threat detection and response automation
• Security as platform for business enablement rather than obstacle
• Core transformation achieved within 18 months

Key Lessons

---

1. Executive sponsorship is essential. Zero Trust transformation is too significant to succeed as a bottom-up initiative. Board-level support, funded program status, and executive accountability were critical success factors.

2. Architecture must accommodate reality. Theoretical Zero Trust purity is less valuable than practical Zero Trust improvement. The architecture explicitly addressed legacy systems, diverse environments, and operational constraints.

3. Implementation is not deployment. Technology deployment is necessary but not sufficient. Operational integration, process updates, and training determine whether technology investments actually deliver security outcomes.

4. Measurement enables improvement. Clear metrics and measurement from program initiation enabled data-driven decisions, demonstrated value to stakeholders, and identified areas requiring additional attention.

Engagement Model

---

This transformation was led internally with architecture leadership and technical direction provided by an embedded expert. This model combined deep organizational knowledge with external expertise, avoiding both the knowledge gaps of pure external consulting and the resource constraints of purely internal delivery.