Vendors will sell you a Zero Trust product. What they cannot sell you is a Zero Trust architecture. That requires strategy, organizational change, and phased investment — here is the implementation roadmap that actually works.