For a long time network security followed a simple picture. There was a protected inside, an untrusted outside and a boundary of firewalls and gateways between them. Anything inside was assumed to be reasonably safe, so internal systems often trusted each other with little further checking. That picture matched a world in which staff worked in offices, applications ran in a data centre and data stayed within the building. Few of those assumptions still hold. Applications run in cloud platforms and as third-party services, people work from anywhere on devices the organisation does not fully control, and attackers who obtain a single credential find themselves behind the boundary. The perimeter still has a role, but it can no longer be the main control.
Where the perimeter model fails
The weakness is not that firewalls stopped working, but that the boundary they defend stopped coinciding with the organisation. Software as a service places business data outside the network entirely. Remote access tools extend the inside to every home connection. Once an attacker is within a flat internal network, lateral movement is easy, because systems that trust one another by location have no way to distinguish a legitimate user from an intruder using stolen credentials. Insiders, whether malicious or simply careless, already have the position the perimeter was meant to protect. Defences that focus on keeping threats out give little help in detecting or limiting what happens after they get in.
What identity-centric defence changes
Identity-centric models, often described as zero trust and set out in documents such as NIST Special Publication 800-207, assume that no request is trusted because of where it comes from. Each request is evaluated on who or what is making it, the state of the device, the sensitivity of the resource and the surrounding context. In practice this means strong authentication, preferably phishing-resistant methods such as FIDO2 security keys and passkeys, short-lived tokens, least-privilege access, device posture checks and continuous evaluation rather than a single login. Network segmentation still matters, but access decisions are made close to the resource and are tied to identity, which limits how far a compromised account can travel.
The new weak points
Moving the weight of security onto identity does not remove risk, it concentrates it. The identity provider becomes the most valuable system an organisation runs, and its compromise would be catastrophic. Attackers adapt by stealing session tokens, tricking users into approving prompts, and abusing account recovery processes. Legacy applications that cannot use modern authentication need gateways or other compensating controls, and service accounts and machine identities are often poorly governed compared with human ones. A sensible migration is incremental, starting with the most sensitive systems, strengthening authentication, inventorying identities and monitoring for abnormal behaviour, rather than attempting to replace everything at once.
Why it matters
Defending an organisation means protecting the places where decisions about access are made. When the network boundary no longer marks the edge of what must be protected, identity, device state and context become the controls that matter, and they need the same investment and monitoring once given to the firewall. Organisations that accept this, and plan for the concentration of risk in their identity systems, are better placed to limit the damage when an account is eventually compromised.
The perimeter did not disappear. It moved to every login prompt.
