Remote work, SaaS, and cloud have dissolved the traditional network perimeter. Zero trust replaces implicit trust based on network location with continuous verification of identity, device, and context, and secure access service edge (SASE) delivers those controls from the cloud. WC1 helps Singapore and Philippine organisations plan and deliver zero trust in practical phases, starting where risk and user pain are highest.
The problem: why zero trust and SASE matters
VPNs give remote users broad network access, and compromised VPN credentials or unpatched VPN appliances remain a leading ransomware entry point. Branch traffic backhauled to headquarters slows SaaS applications, and users find workarounds.
Zero trust is often sold as a product, but it is an architecture and a journey. Without a roadmap, organisations buy tools that overlap, leave legacy access paths open, and frustrate users.
Who this service is for
Organisations with hybrid workforces, multiple branches or sites, offshore development teams, or third-party contractors needing access to internal applications, and those replacing end-of-life VPN or proxy infrastructure.
What WC1 delivers
Every engagement is scoped to your environment and risk. These are the building blocks we combine for zero trust and SASE:
- Zero trust assessment and roadmap: Maturity assessment against models such as CISA’s Zero Trust Maturity Model and a phased roadmap tied to business priorities.
- Zero trust network access (ZTNA): Application-level access for employees and contractors, replacing or reducing VPN, with device posture checks.
- Secure web gateway and CASB: Cloud-delivered web filtering, SaaS visibility and control, and inline data protection.
- SD-WAN and branch transformation: Secure SD-WAN design and rollout so branches reach cloud and SaaS directly with consistent security policy.
- Identity-centric policy: Conditional access policies using identity, device health, location, and risk signals.
- Third-party and ODC access: Secure, auditable access for vendors and offshore teams without flat network access.
How the engagement runs
1. Assess
Map users, applications, access paths, and current network and identity controls.
2. Prioritise
Select first use cases, commonly contractor access, VPN replacement, or branch internet breakout.
3. Pilot
Deploy SASE components for a pilot group, measure user experience, and refine policy.
4. Scale
Roll out by user group and site, and decommission legacy access paths as you go.
5. Govern
Establish policy review, access recertification, and metrics for coverage and incidents.
Commercial shape follows the work: a fixed-scope assessment or implementation when the problem is well bounded, or a retainer when you need ongoing operation, tuning, and reporting. Coverage hours, response times, and responsibilities are written into the statement of work so there are no surprises.
Deliverables you can expect
- Zero trust maturity assessment and phased roadmap
- SASE architecture and vendor evaluation
- ZTNA policies and application onboarding
- SWG, CASB, and SD-WAN configuration
- Conditional access policy set
- Legacy access decommissioning plan
Platforms and tools we integrate
We design and deploy with Palo Alto Networks Prisma SASE and Prisma Access, Zscaler Zero Trust Exchange, Fortinet FortiSASE and Secure SD-WAN, Microsoft Entra Global Secure Access and Conditional Access, Netskope, and Cloudflare One, integrated with your identity provider and endpoint management. Cisco environments are covered too, including Cisco Secure Access and Duo.
WC1 is vendor-neutral: we integrate the platforms you already own before recommending anything new. Naming a product here describes technology we work with; it does not imply a partnership, reseller agreement, or vendor certification.
Singapore: regulatory and market relevance
The MAS TRM Guidelines emphasise strong access control, multi-factor authentication, and network security, and MAS Notice on Cyber Hygiene mandates MFA for system administrators and for access to confidential customer data from the internet. CSA promotes zero trust principles in its guidance, and Singapore government systems are moving toward zero trust architectures under IM8. A phased zero trust programme helps demonstrate these controls.
Philippines: regulatory and market relevance
BSP Circular 982 requires strong access controls and network security, and the rise of remote and hybrid work in Philippine BPO, shared services, and ODC operations makes secure remote access a daily concern. The NPC expects access to personal data to be limited to authorised personnel, which ZTNA and conditional access enforce more precisely than VPNs.
How this fits the rest of your security programme
Zero Trust and SASE rarely stands alone. It works best alongside Identity Security and Access Management, Network Security and Next-Generation Firewalls, Cloud Security and CNAPP, Data Security and DLP. It also connects to our Offshore Development Center in Singapore services. See the full catalogue on our Cybersecurity services page.
Related reading: Zero trust access for ODC engineers: a Singapore buyer checklist.
Frequently asked questions
Is zero trust a product we can buy?
No. It is an architecture based on continuous verification. SASE, ZTNA, and identity platforms are tools that implement it. We help you sequence them sensibly.
Do we have to remove our VPN immediately?
No. Most organisations run ZTNA alongside VPN, move applications and users in waves, and retire the VPN once usage drops.
What is the difference between SASE and SSE?
Security service edge (SSE) covers cloud-delivered security such as SWG, CASB, and ZTNA. SASE adds SD-WAN networking. You can adopt SSE first and add SD-WAN later.
Will users notice a difference?
Usually for the better: faster SaaS access and no VPN to connect. We pilot to catch issues before broad rollout.
How do you handle contractors and offshore teams?
With application-level access tied to their identity and device posture, time-bound where possible, and fully logged.
Next step
Tell us how your staff and contractors reach applications today. We will propose a first zero trust use case and pilot plan. Contact WC1 for a no-obligation conversation; we will tell you honestly if we are not the right fit.