"Zero trust" sounds like an enterprise programme with a seven-figure budget. For a small team it is really a change of default: stop trusting a request because it comes from the office network or the VPN, and verify every request on its own merits.
1. Make identity the new perimeter
Put every app behind one identity provider with single sign-on, and require phishing-resistant MFA (passkeys or security keys) for admins first, then everyone.
2. Check the device, not just the person
A valid login from an unpatched, unencrypted laptop is still a risk. Require disk encryption, a screen lock and automatic updates before a device can reach internal tools.
3. Grant the least privilege that works
Give people access to the systems their role needs, for as long as they need them. Review access every quarter and remove it the same day someone leaves.
4. Replace the flat VPN with per-app access
An identity-aware proxy lets each internal app check who is asking and from which device, instead of opening the whole network to anyone on the VPN.
5. Log access and actually look at it
Central logs of sign-ins and admin actions turn "we think we were not breached" into "we know".
Start with step 1. It removes the most common attack, stolen passwords, and every later step builds on it.