## Why Perimeter Security Failed
The perimeter security model made sense when the enterprise had clear edges. Your servers were in a data centre, your employees were in an office, your applications ran on your own infrastructure. You built a wall around all of it, and whoever was inside the wall was trusted.
That model is obsolete. Your applications are spread across multiple clouds. Your employees work from home, cafes, airports, and client sites. Your data traverses the internet regularly. Your network extends to partners, contractors, and third parties. The "inside" of your network is no longer a meaningful concept — and the trusted-inside/untrusted-outside model is catastrophically wrong for 2026 reality.
Zero trust starts from the premise that no network location, device, or user is inherently trustworthy. Every access request, regardless of where it originates, must be authenticated, authorised, and continuously validated. The question isn't "is this person inside our network?" but "is this verified person, on a known device, with appropriate permissions, asking to access something they should be able to access, in a context that looks normal?"
## The Identity Layer as the New Perimeter
In zero trust architecture, identity becomes the control plane. If the old model secured the network perimeter, zero trust secures the identity perimeter — every access decision flows through identity verification and authorisation.
This means your Identity Provider (IdP) — Azure Active Directory, Okta, Ping Identity — becomes critical infrastructure in a way it probably wasn't before. It's the decision point for every access request. Outages in your IdP equal outages across your applications. This isn't a reason to avoid zero trust; it's a reason to invest appropriately in IdP resilience and high availability.
The IdP's role in zero trust goes beyond authentication. It also provides the identity signals that drive access decisions: is this user's account in a risk state? Has this user been flagged for unusual behaviour? Is the device they're using compliant with your security policies? These signals should flow into your access decisions continuously, not just at login time.
## Implementing Zero Trust: The Practical Roadmap
Zero trust is a multi-year journey, not a product you buy. The realistic implementation roadmap for most enterprises looks something like this:
In the first phase, you build strong identity foundations: deploy multi-factor authentication universally (no exceptions for "VIP" users or service accounts), implement risk-based authentication that challenges users when contextual signals suggest elevated risk, and build a comprehensive device inventory and compliance framework.
In the second phase, you implement application-level access control: move away from network VPN for application access towards identity-aware proxies (like BeyondCorp, Zscaler Private Access, or Azure AD Application Proxy) that verify identity and device compliance for every application access request without granting broad network access.
In the third phase, you implement micro-segmentation: divide your network into small, tightly controlled zones with explicit access policies between them. Even if an attacker compromises one zone, they can't freely move through the rest of the network without triggering controls.
In the fourth phase, you build continuous monitoring and response: implement real-time monitoring of user and device risk signals, with automated response capabilities that can revoke access or challenge users when risk scores increase mid-session.
## The Technology Stack for Zero Trust Identity
The modern zero trust identity stack includes: an enterprise IdP for authentication and identity management, a privileged access management (PAM) solution for privileged accounts, a conditional access policy engine that evaluates context for every access request, an identity governance and administration (IGA) platform for lifecycle management and access certification, and unified endpoint management for device compliance.
Microsoft's integrated zero trust stack (Azure AD, Defender for Endpoint, Intune, Microsoft Sentinel) has a genuine advantage for Microsoft-centric organisations — the level of signal sharing between these components is excellent. For multi-vendor environments, integration work is required but manageable with a well-designed architecture.
*Lara IT Solutions designs and implements zero trust architectures for UK enterprises. Call 0330 043 1930.*