Identity-First Security: The New Perimeter Is Who You Are
Once you accept that network location grants no trust, a question follows immediately: what does? The answer is identity. In cloud and remote-first environments there is no perimeter to defend — the resources are scattered across SaaS and clouds, the users are everywhere, and the only consistent thing every request carries is who is making it. Identity has become the primary security boundary, which means it is also the primary target.
"Identity-first" means treating the identity layer — the directory, the authentication, the authorization decisions — as the control plane where security is actually enforced. It is a rational response to reality: attackers have noticed that in a cloud world, they no longer need to breach a network perimeter that barely exists. They need to log in. Compromised credentials and abused identities are now among the most common ways into an environment, precisely because identity became the door.
Authentication, then authorization, then lifecycle
Identity security has three layers, and weakness in any one undoes the others. Authentication proves who is asking — and passwords alone no longer do, because they are phished, reused, and dumped at scale; phishing-resistant multi-factor authentication is the current bar. Authorization decides what that proven identity may do — and this is where least privilege lives or dies. Lifecycle governs how identities are created, changed, and — critically — removed, because the access that outlives its purpose is the access attackers inherit.
The quiet killers: standing privilege and dead accounts
Two identity problems cause an outsized share of breaches. The first is standing privilege — accounts, especially service accounts and admins, holding powerful permissions permanently, whether or not they are in use. Every one is a high-value target sitting idle. The second is orphaned access — the contractor who left, the employee who changed roles, the integration nobody decommissioned — access that persists after its reason for existing is gone. Both are invisible on a good day and catastrophic on a bad one.
- Make strong MFA non-negotiable. Phishing-resistant factors on every account that matters, especially privileged ones. A password-only admin account is a breach waiting for a phishing email.
- Move to just-in-time privilege. Grant elevated access for the task and the window, then revoke it. Standing admin rights are a target that exists whether or not anyone is using them.
- Govern the lifecycle. Access should be provisioned to a role and removed automatically when the role changes or ends. Manual deprovisioning is how orphaned accounts are born.
- Watch service accounts closely. Non-human identities are numerous, over-privileged, rarely rotated, and almost never watched — a favourite of attackers for exactly those reasons.
- Detect on identity behaviour. Impossible travel, a dormant account waking, a sudden privilege spike — the anomalies that reveal a stolen credential live in the identity logs.
- Pull your list of privileged accounts and find the ones that haven’t authenticated in 90 days. Each is standing access with no current owner — exactly what an attacker hopes to inherit.
- Pick one person who left recently and trace whether every access they held is actually gone — across SaaS, cloud, and internal apps, not just the primary directory. The gaps are where offboarding quietly failed.
Enumerating standing privilege, orphaned access, and over-permissioned service accounts across your identity estate is exactly the sprawl our assessment maps — because the identity you forgot is the one that gets abused.
When the perimeter dissolved, identity quietly became the thing worth defending most and watching hardest. An attacker no longer has to break in when they can log in, which makes every credential, every permission, and every forgotten account part of your attack surface. Treating identity as the control plane — strong at authentication, tight at authorization, disciplined through the lifecycle — is what remains once the network can no longer be trusted. And you cannot govern the identities and access you never knew you granted.