BeyondCorp and the Death of the Perimeter
After a sophisticated intrusion in 2009, Google reached an uncomfortable conclusion: the corporate network was not a safe place, and pretending otherwise was the root of the problem. Its response, published as the BeyondCorp papers, was radical for its time — treat the internal network as no more trustworthy than the open internet, and move all access decisions to the identity and the device. It is the most influential real-world blueprint for what the industry now calls Zero Trust.
The traditional model tied access to the network: connect to the corporate LAN or dial in over a VPN, and you were "inside," trusted. BeyondCorp severed that link entirely. Under it, being on the corporate network grants you nothing. Every request to every internal application is authenticated and authorized based on who you are and what device you are on, whether you are in headquarters or a coffee shop. The network became just transport — plumbing, not a trust boundary.
The device is half the decision
BeyondCorp's insight that many imitations miss is that identity alone is not enough — the device matters just as much. A valid user on a compromised, unmanaged, or out-of-date machine is a risk that a correct password does nothing to address. So access decisions incorporate device state: is this machine known to us, managed, patched, encrypted, healthy? A request from a trusted identity on an untrusted device is treated with suspicion, because that combination is exactly what a stolen credential on an attacker's laptop looks like.
What it takes to actually get there
BeyondCorp is aspirational for most organisations because it demands foundations many lack: a reliable inventory of devices and their health, a strong identity system, and every internal application fronted by an access proxy rather than exposed on a trusted network. The hard part is not the concept but the migration — and, as always, the exceptions. The legacy application that cannot sit behind the proxy, the admin interface still reachable on the flat network, are where the old trusted-LAN model survives and where an attacker will aim.
- Inventory devices and measure their health. You cannot factor device trust into a decision you can’t make — device posture requires actually knowing your fleet.
- Front applications with an access proxy. The enforcement point only works if every request goes through it. An app reachable around it is an app outside the model.
- Decide per request, not per session. Trust is a snapshot; a device that was healthy at login can be compromised an hour later. Re-evaluate continuously.
- Hunt the exceptions relentlessly. The un-proxied legacy system is the whole perimeter model, quietly resurrected in one corner of your estate.
- Try reaching one internal application from an unmanaged device with valid credentials. If it lets you straight in, device trust isn’t actually part of your access decision.
- Ask which internal systems are still reachable directly on the network rather than through an access proxy. That list is precisely where the old trusted-LAN assumptions still live.
Finding the applications and paths that still trust the network — the exceptions that undo a BeyondCorp-style model — is what our assessment surfaces, because the perimeter dies unevenly and the survivors are the risk.
BeyondCorp mattered because it was not a whitepaper theory — it was a company the size of Google betting its own security on the idea that the internal network deserves no trust, and making it work. The industry spent the following decade catching up and renaming it. Whatever you call it, the lesson holds: the perimeter is dead, trust is computed per request from identity and device, and the network is just wire. And you cannot retire the perimeter for systems you never knew were hiding behind it.