{"id":6626,"date":"2026-01-20T10:15:00","date_gmt":"2026-01-20T10:15:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=6626"},"modified":"2026-01-20T10:15:00","modified_gmt":"2026-01-20T10:15:00","slug":"why-the-future-of-security-starts-with-who-not-where","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=6626","title":{"rendered":"Why the future of security starts with who, not where"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

For a long time, cybersecurity was pretty straightforward: Guard the edges, and everything inside should be fine. Firewalls, DMZs, VPNs \u2014 these were the go-to tools. Back then, it worked. Apps lived in data centers, and everyone showed up at the office. But that world disappeared before most companies even noticed.<\/p>\n

Remote work, cloud adoption and distributed applications slowly dissolved the network edge. And attackers took advantage of that gap long before defenders adapted. Verizon\u2019s annual Data Breach Investigations Report<\/a> repeatedly shows that a large portion \u2014 often over 80% \u2014 of modern breaches involve compromised credentials, not network flaws.<\/p>\n

That number says a lot. It tells us the perimeter didn\u2019t just shift \u2014 it collapsed around identity.<\/p>\n

<\/a>The old perimeter: Strong walls, weak assumptions<\/h2>\n

Traditional security assumed one thing: \u201cIf someone is inside the network, they can be trusted.\u201d<\/p>\n

That assumption worked when offices were closed environments and systems lived behind a single controlled gateway. But as Microsoft highlights in its Digital Defense Report<\/a>, attackers have moved almost entirely toward identity-based attacks because stealing credentials offers far more access than exploiting firewalls.<\/p>\n

In other words, attackers stopped trying to break in. They simply started logging in.<\/p>\n

<\/a>Cloud + remote work = No perimeter<\/h2>\n

Now, with remote work and the cloud, there\u2019s no real perimeter left. People connect from home Wi-Fi, personal laptops, airports, coffee shops \u2014 you name it. At the same time, company data and workloads are scattered across AWS, Azure, Google Cloud and various SaaS platforms. The old rules just don\u2019t fit anymore.<\/p>\n

There is no single \u201cinside\u201d anymore. There is only identity \u2014 the user behind the request.<\/p>\n

This is why modern security frameworks, including NIST\u2019s Zero Trust Architecture guidelines (SP 800-207)<\/a>, emphasise identity as the primary control point rather than the network.<\/p>\n

<\/a>Identity is now the primary attack surface<\/h2>\n

Identity brings convenience, but it also brings complexity \u2014 and complexity attracts attackers.<\/p>\n

People reuse passwords.<\/p>\n

MFA fatigue attacks work far too often.<\/p>\n

Privileged accounts get over-granted. Contractors keep access long after their projects end.<\/p>\n

Service accounts multiply with no owner.<\/p>\n

Okta\u2019s recent State of Identity Security report<\/a> points out that identity misuse has become one of the fastest-growing attack vectors in enterprises.<\/p>\n

Identity is no longer just a log-in step. It\u2019s now the attacker\u2019s first target.<\/p>\n

<\/a>Zero trust made identity the first door to lock<\/h1>\n

Zero trust isn\u2019t about paranoia. It\u2019s about verification. Never trust, always verify only works if identity sits at the center of every access decision.<\/p>\n

That\u2019s why CISA\u2019s zero trust maturity model<\/a> outlines identity as the foundation on which all other zero trust pillars rest \u2014 including network segmentation, data security, device posture and automation.<\/p>\n

A strong identity-based perimeter includes:<\/p>\n

MFA everywhere<\/p>\n

SSO to reduce password fatigue<\/p>\n

Role-based access controls<\/p>\n

Privileged Access Management<\/p>\n

Device trust tied to user identity<\/p>\n

Continuous monitoring of user behaviour<\/p>\n

Adaptive, risk-based access policies<\/p>\n

This isn\u2019t the future \u2014 this is what\u2019s expected today.<\/p>\n

<\/a>Identity done right requires real discipline<\/h2>\n

When identity becomes the perimeter, it can\u2019t be an afterthought. It needs to be treated like core infrastructure. That means:<\/p>\n

Identity has to be engineered, not patched together.<\/strong> Lifecycle processes must be streamlined \u2014 joiners, movers and leavers must be tightly controlled.<\/p>\n

Privilege needs to be what people earn, not what they start with.<\/strong> Excess-access is still one of the top contributors to breaches.<\/p>\n

Authentication methods need to evolve yearly.<\/strong> Static MFA policies won\u2019t survive dynamic threats.<\/p>\n

Monitoring must follow behavior, not networks.<\/strong> Suspicious activity often hides in user patterns, not traffic flows.<\/p>\n

Identity ownership must be shared across security, IT and the business.<\/strong> Identity doesn\u2019t succeed unless everyone is accountable.<\/p>\n

Gartner has been emphasising this shift for years, calling identity \u201cthe new security perimeter\u201d in multiple research publications aimed at CISOs and enterprise architects<\/p>\n

<\/a>Where we\u2019re heading next<\/h2>\n

Identity is already at the centre of modern cybersecurity, but its role is only going to grow stronger. Over the next few years:<\/p>\n

Passwords will fade out in favour of passkeys and biometrics.<\/p>\n

Machine identities will become as critical as human identities.<\/p>\n

Access decisions will adapt in real time based on behaviour.<\/p>\n

Identity platforms will become the central nervous system of enterprise security.<\/p>\n

Zero Trust will mature from architecture diagrams into everyday practice.<\/p>\n

Organizations that invest in strong identity foundations won\u2019t just improve security \u2014 they\u2019ll improve operations, compliance, resilience and trust. Because when identity is solid, everything else becomes clearer: who can access what, who is responsible for what and where risk actually lives.<\/p>\n

The companies that struggle will be the ones trying to secure a world that no longer exists \u2014 a perimeter that disappeared years ago.<\/p>\n

Identity isn\u2019t just the new perimeter.<\/p>\n

It\u2019s the new beginning.<\/p>\n

Everything starts here now.<\/p>\n

This article is published as part of the Foundry Expert Contributor Network.
<\/strong>Want to join?<\/strong><\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

For a long time, cybersecurity was pretty straightforward: Guard the edges, and everything inside should be fine. Firewalls, DMZs, VPNs \u2014 these were the go-to tools. Back then, it worked. Apps lived in data centers, and everyone showed up at the office. But that world disappeared before most companies even noticed. Remote work, cloud adoption […]<\/p>\n","protected":false},"author":0,"featured_media":6627,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-6626","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/6626"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6626"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/6626\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/6627"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6626"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6626"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6626"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}