For a long time, the network perimeter was the primary place security control lived: a firewall, a VPN, a boundary between trusted and untrusted. That boundary has been dissolving for years — remote work, cloud services and third-party integrations all punch through it — and identity has quietly become the control point that actually matters. Plenty of governance programmes still write risk registers as though the old boundary is where the real exposure sits.What Changed and Why the Old Model Undercounts RiskWhen most access to sensitive systems happens over the open internet through an authenticated session rather than inside a trusted network segment, a compromised credential is functionally equivalent to a breached perimeter — except it rarely appears with the same urgency in a risk register built around network zones. A phished password or a leaked API key now grants the kind of access a firewall rule used to be the last line of defence against.What an Identity-Centred Risk View Actually RequiresPrivileged access treated as its own risk category: not folded into a general "access control" line that never gets board-level attention on its own.Session and token lifetime as a governed control: a long-lived, unrevoked session is a standing exposure whether or not anyone is actively misusing it.Third-party and machine identities counted, not just human ones: a service account or an API integration with standing access is a credential like any other, and often a less-monitored one.An incident playbook that assumes identity, not the network, is the first thing compromised: so the first questions in a real incident are about who authenticated and from where, not which network segment was breached.“A firewall rule protects a boundary. An identity governs everyone who is allowed to cross it — which means identity, not the boundary, is where the real risk decision now sits.”Updating the Model, Not Just the ToolingThis is not primarily a tooling gap — most organizations already run identity and access management platforms capable of enforcing much stricter controls than they currently do. It is a governance gap: the risk register, the board reporting and the incident playbook were built around a boundary that stopped being the primary control years before the paperwork caught up.Share this articleX (Twitter)LinkedInFacebookCopy Link
Digital IdentityAug 13, 2026Why Decentralised Identity Still Needs a Governance OwnerDecentralised and verifiable-credential identity models promise less reliance on any single identity provider. They do not remove the need for someone inside the organization to own what gets trusted and why.
Digital TrustJun 18, 2026Trust Is Becoming a Measurable Claim, Not a Marketing Line"We take security seriously" used to be an acceptable answer to a customer's due-diligence question. Buyers are increasingly asking for evidence instead.
Quantum ThreatsSep 10, 2026Quantum Computing and Cryptographic Risk: Preparing for Y2QY2Q — the point at which a capable quantum computer breaks today's public-key cryptography — isn't a single future date. Data being encrypted today can already be harvested and held for decryption later.
