Identity is the new perimeter

The Verizon Data Breach Investigations Report has tracked the same uncomfortable fact for years: the use of stolen credentials remains one of the most common ways attackers first get into an organisation. In the 2024 edition, Verizon also reported that the human element was a factor in the large majority of breaches it studied. The number moves a little each year. The lesson does not. People, and the accounts that represent them, are now the way in.

That single finding has quietly rearranged how defenders think about boundaries. For two decades the perimeter was a place. It had an address range, a firewall, a demilitarised zone, and a clear inside and outside. An attacker had to break through the wall. Today the wall has dissolved into laptops at kitchen tables, software running in other companies' data centres, and contractors signing in from networks nobody controls. The thing that still draws a line between trusted and untrusted is identity.

So the question every security team now answers, dozens of times a second, is no longer where is the request coming from. It is who is this, really, and should they be allowed to do what they are asking to do.

How a place became a login

The shift was gradual enough that many organisations only noticed it after the fact. A firewall once sat at a known address, and the act of being inside the network was itself a kind of credential. Then the work moved. Staff signed in from home, applications moved to platforms owned by other companies, and the address an attacker came from stopped meaning very much at all.

What survived the move was the login. Wherever a request originates, it still has to prove who is making it, and that proof is the only thing left that an attacker cannot simply route around. The boundary did not disappear. It changed shape, from a line on a network diagram to a question asked at every door.

What the old perimeter actually protected

It helps to be honest about what the network boundary was ever good for. It assumed that anything inside the corporate network had already earned a degree of trust, and anything outside had not. That worked while staff sat at desks, applications ran on servers down the corridor, and the only way in was through a small number of guarded doors.

Three shifts broke the assumption. Remote and hybrid working scattered the workforce. Cloud platforms moved the applications off the corporate network entirely. Supply chains threaded third parties deep into systems that used to be sealed. In each case the request now arrives from somewhere the old map called outside, carrying a credential that says it belongs inside. The wall cannot tell the difference. An identity check can.

Why credentials became the target

Attackers are economical. They take the cheapest route that works, and a working password is far cheaper than an exploit chain. ENISA, the European Union Agency for Cybersecurity, has repeatedly placed attacks against availability and the abuse of legitimate access among the dominant threats it tracks across the continent. The UK's National Cyber Security Centre has made the same point in plainer language for years: many serious intrusions begin with a stolen credential that should never have been usable from where it was used, rather than with a clever zero day.

Phishing harvests passwords. Information-stealing malware lifts session tokens straight from a browser. Criminal markets resell access to corporate accounts the way a locksmith might sell copied keys. Once an attacker holds a valid identity, much of the defensive machinery built to spot intruders waves them straight through, because as far as the system can tell, they belong.

The principles defenders are building around

The response has a name that has been worn thin by marketing, so it is worth stating in concrete terms. Zero trust simply means an organisation stops assuming a request is safe because of where it came from, and verifies it every time instead. In practice, the teams doing this well share a handful of habits.

They make strong authentication the default, and they favour methods that resist phishing rather than ones that can be tricked out of a one-time code. They grant the least access a person needs to do the job, and they take it back when the job changes. They watch what identities do after login, not only at the door, so an account behaving strangely raises a flag even though its password was correct. They treat machine identities, the accounts that software uses to talk to other software, as seriously as human ones, because there are now far more of them.

None of this is a product you can buy and switch on. It is a long programme of unglamorous work: cleaning up dormant accounts, untangling who has access to what, and persuading busy colleagues to adopt a slightly less convenient login. The people who carry that work rarely get to point at a dramatic save. They get to point at the incident that never happened.

Who does this work, and why it is hard to see

Consider the identity and access engineer who spends a quarter reducing the number of people with administrative rights from several hundred to a few dozen. There is no headline in it. The systems look the same the morning after as they did the morning before. The only visible change arrives months later, when an attacker who phishes one ordinary employee finds that the stolen account opens almost nothing, and the intrusion stalls before it starts.

Or consider the analyst on a Tuesday night shift who notices that a finance account is signing in from a plausible city but at an implausible hour, against a pattern that has held for two years. They make a call, lock the session, and ring a colleague who is asleep. If they are right, a fraud is stopped. If they are wrong, they have inconvenienced one tired person. Either way, the work is invisible to everyone except the few who understand what was at stake.

This is the work the field has historically struggled to recognise, because it produces no artefact to admire. A merit-based award exists precisely to name it. When recognition is judged on the evidence of what someone did, and never bought, the engineer who quietly shrank the blast radius and the analyst who caught the impossible login can finally be put on the record by the colleagues who watched them do it.

What the next few years ask of the field

The boundary keeps moving. Generative tools now act on people's behalf, holding their own credentials and permissions, which means the identity question soon has to be answered for software agents as carefully as it is for staff. Attackers are using the same tools to make their lures more convincing, which raises the value of authentication that cannot be talked out of someone over the phone. And as more of the economy runs through a handful of shared platforms, a single identity provider becomes both the strongest lock and the most valuable target.

The defenders who rise to this will not be the loudest. They will be the ones who treat every login as a question rather than a formality, who do the patient cleanup nobody applauds, and who keep asking the only question the new perimeter cares about. If identity is now the line between trusted and untrusted, who in your organisation is quietly making sure it holds, and when did you last tell them it mattered?