The perimeter-based security model is dead. Enterprise organisations that cling to VPNs and firewalls as their primary defence are operating with a fundamentally broken assumption: that anything inside the network can be trusted.
The perimeter model is dead
For twenty years, enterprise security assumed a hard shell and a soft center: a firewall and VPN at the edge, implicit trust for anything already inside. That assumption breaks the moment an employee's laptop is compromised, a vendor's credentials leak, or a contractor connects from an unmanaged device — which is to say, constantly. Zero-trust replaces the assumption with a rule: every request is authenticated, authorized, and encrypted, regardless of where it originates.
What zero-trust actually requires
Zero-trust is not a product you buy. It is three architectural commitments: identity-based access control that treats every user and service account individually; micro-segmentation that stops lateral movement between systems, so a breach in one application doesn't become a breach of the network; and continuous verification, where a session is re-checked against context — device posture, location, behaviour — rather than trusted for its lifetime after a single login.
A realistic rollout sequence
Organisations that try to convert everything at once stall for a year. The sequence that works: inventory every identity and its current access, since most companies are surprised by what they find; enforce multi-factor authentication everywhere, with no exceptions for legacy systems; segment the network around your highest-value systems first — financial data, customer records, production infrastructure — not the easiest systems to migrate; and only then extend the model outward.
What to measure
Track mean time to detect lateral movement, the percentage of access grants that are role-based versus manually approved, and the number of standing, always-on privileged accounts — that last number should trend toward zero. A zero-trust program that isn't reducing standing privilege isn't actually zero-trust; it's a marketing label on the same perimeter model.