Zero trust architecture for cloud and hybrid environments

SEYA Group designs zero trust access for cloud and hybrid environments: every request is checked for identity, device, and the smallest permission that job needs, whether the caller is a person, a pipeline, or a workload. The work is a phased roadmap your team can run, not a product you rip the network out to install. Engagements are led by senior engineers from our Vancouver office.

Who this is for

Security and infrastructure leads whose VPN still treats the office network as trusted, or whose cloud accounts grew a long list of standing admin roles. Teams that have a merger, a remote workforce, or a customer review asking how a contractor reaches production. Architects who want workload identity sorted out before an agent or a pipeline is given cloud permissions.

What you get

• Identity. A map of workforce identity, privileged roles, and service accounts, and a recommendation for which access should be just-in-time rather than standing. We use the identity system you already have.
• Device. The signals you can actually collect today (managed device, posture check, or none) and which applications should refuse a device that fails them. We do not invent a device estate you do not operate.
• Network segmentation. Which paths should remain, which should be identity-aware, and which broad rules should close. Segmentation is written against the accounts in scope, not against a greenfield diagram that ignores the current VPC or VNet.
• Workload identity. How a pipeline, a pod, or a service proves who it is without a long-lived key in a repository. This is the piece that connects zero trust to DevSecOps.
• A phased roadmap. What changes in the first phase without stopping delivery, what waits for an application owner, and what is explicitly deferred.

How an engagement runs

• Phase 1, see the access. Inventory of human and workload identities and the paths into the environments you name.
• Phase 2, close the obvious gaps. Standing admin removed or time-boxed, public management paths restricted, and logging confirmed. These changes are reviewed with your operators before they ship.
• Phase 3, the steady model. Policy for new accounts and new workloads so the next project does not recreate the old pattern. Misconfigurations found along the way are handled with the cloud security posture review rather than left as a slide.

What you need in place

An identity owner, an infrastructure owner, and read access to the directories and cloud accounts in scope. Applications that cannot change their login in the first phase stay on the roadmap with a reason, instead of being forced into a cutover. If the estate itself is still being designed as a new landing zone and security is not the reason for the project, say so on the scoping call. This service assumes you want the access model. It does not assume you want a data-centre exit.

The closest published example is LiveRamp's Google Cloud foundation, which separated environments and applied granular IAM. That was foundation design for a first cloud, and the identity decisions are the part that belongs on this page.

Questions buyers ask

Do we have to remove the VPN in the first phase?

No. The first phase is usually identity and admin access. Network changes that would stop a plant, a store, or a call centre wait until the application owners have a tested path. Zero trust here is a sequence, not a weekend cutover.

Is this a zero trust product implementation?

It can include configuring the identity and access products you already licence. SEYA does not require a particular vendor, and we do not sell a zero trust appliance. The deliverable is the access model and the changes you agree to make.

How does this relate to a cloud security review?

A posture review lists misconfigurations on a date. Zero trust is the access model you want those accounts to converge on. Many engagements start with the review so the roadmap is based on the access you actually have.

Book a cloud security assessment if privileged access or the office VPN is the question you have been asked to answer.