Identity Is the New Perimeter — and Most Teams Botch It
For years we drew security as a wall. Inside the wall, good; outside, bad. Spend the budget on the perimeter, trust what’s within it, and sleep at night. Then everyone’s data moved to the cloud, everyone started working from their kitchen, and the wall quietly stopped existing. There’s no “inside” anymore — your data lives in a dozen SaaS platforms, your people log in from everywhere, and the network you used to defend is just one of many roads to the things that matter. So what’s left to defend? Identity — who someone is and what they’re allowed to do. That’s the perimeter now, and a lot of teams are still pouring money into guarding a wall that isn’t there.
Every breach is an identity story
Pull the thread on almost any modern breach and you land on identity: a stolen credential, an over-privileged account, a service token nobody rotated, a former employee whose access never got turned off. The attacker rarely “breaks in” in the Hollywood sense. They log in — with something that was supposed to belong to someone else, through a front door you left unlocked. It’s far less dramatic than the movies and far more common: no exotic exploit, just valid credentials used by the wrong hands, walking past defenses that were built to spot intruders and never taught to question a legitimate login.
The four failures I check first
When I assess an identity program, I look for the same four failures, because they’re the ones that show up in the post-mortems. Weak authentication — a stolen password alone is enough to get in. Too much privilege — accounts that can reach far more than their job requires, so one compromise becomes total. Stale secrets — tokens, keys, and service-account passwords that were set once and never rotated, sitting in the environment like unattended keys. And broken deprovisioning — access that outlives the person’s need for it. Almost every identity-driven breach is one or more of those four, and none of them are exotic. They’re boring, and boring is exactly why they don’t get fixed.
The unglamorous fixes that work
Strong authentication, so a stolen password isn’t game over — this is the single highest-leverage control in security right now, and it’s the one most attacks are designed to get around, which tells you how much it matters. Least privilege, so a compromised account can’t reach the whole kingdom — the difference between an incident and a catastrophe is usually just how far the stolen account could go. And the one everyone skips: deprovisioning. I’ve walked into companies with active accounts for people who left years ago — live logins, real access, attached to nobody. That’s not an edge case. It’s the front door left open with a welcome mat, and it’s in almost every environment I’ve ever reviewed.
The machines outnumber the humans now
Here’s the part that catches teams off guard: most of the identities in your environment aren’t people. They’re service accounts, API keys, tokens, and automated processes — and they usually outnumber your human users by a wide margin. Nobody rotates them, nobody reviews them, and they frequently hold far more standing access than any human would be allowed, because it was “easier that way” when someone set up the integration at 2 a.m. under a deadline. Attackers know this. A leaked API key with broad permissions is often a cleaner path in than any human account, because it has no MFA, no one watching it, and no expectation that it will ever log in from somewhere strange. Machine identity is the quiet frontier, and it’s where a lot of the next decade’s breaches are going to come from.
Access has to follow the person’s life
Identity isn’t a one-time grant; it’s a lifecycle. Someone joins and gets access. They move to a new team and — if you’re not careful — keep the old access and pick up the new, accumulating permissions like sediment until a mid-level employee can quietly touch half the company. They leave, and the access should vanish the same day. Getting that joiner-mover-leaver flow right is unglamorous plumbing, and it’s worth more than most of the shiny tools, because it’s the difference between access that reflects what people actually need today and access that reflects every role anyone ever held.
None of this is exciting. There’s no glowing threat map, no dramatic intercept, no story that sounds good at a conference. But identity is where the actual fight is now, and the teams that win it are the ones willing to do the boring, continuous work of knowing exactly who — and what — can touch what, and taking it away the moment they shouldn’t have it anymore. Guard the thing the attackers are actually using. It isn’t the wall. It hasn’t been for years.