Your zero-trust programme has no budget for its last 20%, so the legacy path an attacker prefers stays up — how do you get the ending funded?

## Why the ending is always unfunded Migration programmes are funded per unit of visible progress: applications moved, shops enabled, users onboarded. Decommissioning produces no demo. It produces an absence — a circuit that is no longer billed, a firewall policy that shrinks, a front door that stops existing — and absences do not get their own budget line. So the predictable end state is the one you are in. Eighty percent of applications are behind the broker, the twenty percent left are the ones nobody wants (a vendor application that cannot do modern authentication, a till platform under a support contract that forbids changes, an appliance whose supplier is out of business), and because those twenty percent still need the legacy path, the path stays up — which means the eighty percent got a stronger front door and the estate got a second one, not a replacement. ## Reframe the ask: price the double estate Stop asking for money to "finish zero trust". Ask for a decision between two costed options: keep running two estates indefinitely, or fund an ending with a date. The running cost of two estates is concrete and mostly already being paid by someone: | Line | Owner who feels it | | --- | --- | | Private circuit contract, unchanged | Network budget | | Rented edge subscription | Security budget | | Two policy sets reviewed and reconciled | Engineering time, every quarter | | Two incomplete access records at audit | Whoever answers the auditor | | Standing exposure of the least-watched path | Nobody, until it is everybody | That last line is the one you must state plainly and without melodrama: for any application still reachable over the circuit, the effective admission test is position on a shop network, and it is now the path with the least engineering attention because attention followed the new project. ## Move the decision to someone who can refuse An unfunded risk with no owner is a risk that persists. Convert it into a decision that a named person has to make repeatedly: - Every application still on the legacy path gets a **named business owner**, not an IT owner. - Each gets a **dated exception** — an expiry, not a status. Exceptions without dates fund nothing; exceptions with dates create a meeting. - Each expiry is renewed at a **named forum** with the owner present, and renewal is a signature, not a silence. This does not create budget by itself. It creates the only thing that reliably does: a recurring, minuted moment where someone senior must either pay to end it or personally accept it again. Two or three renewals in, the accounting usually changes. ## Sequence to retire paths, not to bank wins The second lever is the rollout order, and it is where most programmes lose. Migrating twelve easy applications and leaving one hard one on the circuit retires nothing; migrating three applications that happen to be the last things on one route lets you switch the route off. So choose the next wave by what it lets you **turn off**, not by how quickly it moves the application counter. A wave that ends with a path retired produces a real saving to point at, and that saving is the argument for the next wave. This is also the point where you may honestly recommend *stopping* breadth: spend the remaining money killing one path completely for a subset of the estate, rather than adding a thin new path everywhere. ## Handle the genuinely immovable Some of the last twenty percent will not move. For those, the goal shifts from migration to isolation: the application keeps the legacy path, but that path is narrowed until it reaches only that application from only the networks that need it, with the exception dated and signed. That is a much smaller surviving surface than "the circuit is still up", and it can often be delivered with the money you already have. ## Report honestly The reporting change is the hardest and the most valuable. Until a path is retired for an application, that application's risk is unchanged, so the programme is not eighty percent done — it is eighty percent invested and zero percent realised. Leaders will not enjoy the sentence, but it is the sentence that funds the ending, and stating it is the job. Pair it with the date you propose for the first path retirement and the cost of getting there, so the conversation is about a plan rather than a complaint. ## How to answer well Name the structural cause in one sentence, price the interim state, put dated owner-signed exceptions on the remainder, sequence waves to empty paths, and change the completion metric. If you also say which of these you would do first with no new money — the exceptions and the reporting, because both are free — you have answered as someone who has actually held this programme.