For years, security teams poured their budgets into firewalls, network zones and perimeter defences. That model is fading. As workloads spread across cloud, SaaS and automation, the boundary that matters most is no longer the network but the identity behind every request. Attackers understand this, and increasingly they log in rather than break in. The good news is that identity, done well, becomes the single most powerful control in the enterprise. Here are six steps to get there.
1. Treat identity as the control plane — The first shift is mindset. Identity is no longer a supporting service; it is the primary place where trust decisions are made. Every access request, whether from a person, a workload or an AI agent, should be authenticated and authorised against real-time context. This is the core reason the new security perimeter is identity, not the network. Designing around this principle turns identity from an afterthought into the foundation of the architecture.
2. Enforce strong, phishing-resistant authentication — Passwords alone are a liability. Multi-factor authentication is the baseline, but the future belongs to phishing-resistant methods such as passkeys and hardware-backed credentials. Removing shared secrets and legacy protocols closes the door on the most common route to compromise, and it does so without adding friction for legitimate users.
3. Apply least privilege everywhere — Every identity should hold the minimum access needed to do its job, and no more. Standing privileges are a gift to attackers, so entitlements should be scoped tightly, granted just in time and revoked automatically when no longer needed. Least privilege limits the blast radius of any single compromise, which is the difference between a contained incident and a full breach.
4. Govern non-human and AI identities — Service accounts, API keys, workloads and AI agents now vastly outnumber human users, yet they are often the least governed. The critical question shifts from what an identity can do to what it is allowed to do. Extending identity governance to machine and AI identities, with scoped permissions, rotated credentials and full logging, is now a central design requirement rather than an optional extra, a theme explored across current perspectives on AI governance and emerging threats.
5. Verify continuously, not just at login — A single check at sign-in is not enough. A strong identity model evaluates risk throughout the session, watching for changes in device posture, location and behaviour. When context shifts, access can be stepped up, challenged or revoked. This continuous verification is the heart of a modern zero trust approach, where trust is earned repeatedly rather than granted once.
6. Monitor identity as a first-class signal — Identity events are among the richest sources of early attack signal. Feeding sign-in logs, privilege changes and anomalous access into detection tooling lets teams spot credential abuse and lateral movement before it escalates. Treating identity telemetry as a first-class input, alongside endpoint and network data, closes the gap between a compromised account and a detected one.
The bottom line — Identity is no longer one control among many; it is the control that governs all the others. Make it the control plane, secure it with strong authentication and least privilege, extend it to machines and AI, verify continuously and watch it closely. Do this, and identity stops being the weakest link and becomes the strongest defence the enterprise has.
