- The traditional security model that assumes there is a clear perimeter, fixed IT environments, and predictable access can no longer protect organizations.
- Implementing point solutions is not the answer: They add unnecessary complexity while still leaving security gaps.
- The path to modern, adaptive security begins with overturning conventional assumptions.
For decades, the enterprise security playbook remained unchanged. IT and security teams followed long-accepted rules: Strengthen your perimeter. Keep your apps patched and updated. And control who can access technology resources.
But today, shifts in the way businesses operate are exposing some serious flaws in that playbook.
According to one recent report on cloud use, 73% of surveyed organizations use a hybrid cloud model of IT, with some combination of public and private cloud environments.1 And their cloud-based tech stack is constantly changing. Meanwhile, they have a hybrid workforce that needs to access enterprise resources from anywhere.
Security built on yesterday’s enterprise model—when employees worked at corporate offices, and workloads lived in a single data center—is not built for today’s environment.
Many organizations try to spend their way to security. But spending without a cohesive strategy fails: It leaves security gaps and creates management complexity that places additional strains on IT and security teams.
The first step in modernizing security for today’s threats is understanding why yesterday’s assumptions shouldn’t be today’s foundation.
Previous Assumptions No Longer Hold
Most traditional security architectures were built on three assumptions: The perimeter is clearly defined. Infrastructure is static. And access is predictable. Each one of those assumptions has collapsed.
The perimeter has dissolved
When enterprise employees worked primarily in corporate offices, and accessed software and data located in corporate data centers, the perimeter model made sense. Security teams could implement hardware firewalls, intrusion detection systems, and VPNs to control a well-defined boundary.
But where is that boundary now?
Organizations rely on cloud-based apps to run their business and store even their most sensitive data in cloud environments. And while some organizations have instituted return-to-office policies, the hybrid work model is here to stay. Employees expect simple, reliable, and secure connectivity wherever they are.
Investing in perimeter-focused controls will do little to stop today’s attackers. Those attackers are not trying to breach a data center’s perimeter—they are targeting identities, infiltrating cloud services, and disrupting applications that are nowhere near a traditional network perimeter.
Infrastructure is in flux
IT and security teams need to identify vulnerabilities fast, before they are exploited. Even waiting for patches to appear might be too late. The Google Threat Intelligence Group found that exploits now happen several days before patches are released.2
Finding those problem spots early requires clear visibility into an IT environment: Teams have to know what they should protect. But that’s difficult when the environment is constantly changing. Developers create new environments on demand, spinning up cloud resources in minutes and using containers for hours. The serverless functions that they put into production might only run for a few seconds at a time.
These temporary test and production environments are extremely difficult to track, let alone secure. By the time an IT team creates a traditional inventory of cloud resources, for example, some of these environments might already have been exposed to attackers.
Access is unpredictable
It’s much easier to protect an environment when IT and security teams know what resources employees will be accessing, when, and from where. But today, access is highly unpredictable. A member of the sales team might need to use an app after landing several time zones away from headquarters; a marketer might be working from a new café; and an overseas developer might tap into a new cloud service, without prior IT authorization. Using strict, static rules for identity management will cause frustrating experiences and impact productivity while still leaving the organization vulnerable.
Meanwhile, IT and security teams have many more identities to manage. Beyond the humans accessing numerous apps from multiple locations, these teams might also have to manage machine identities—the service accounts, APIs, automation tools, and cloud workloads that often outnumber human users.
Frequent changes in accounts and identities further complicate management. As employees come and go, and projects are completed, organizations might accumulate dormant accounts and permissions. The resulting web of privileges, exceptions, and forgotten credentials are prime targets for attackers.
Security Needs a New Operating Model
Many security leaders respond to new threats by adding new tools. A new vulnerability appears? Deploy another scanner. A new attack vector emerges? Purchase another detection solution. According to IBM, organizations use an average of 83 different security solutions from 29 vendors.3
There are multiple problems with that approach. First, adding numerous point solutions (especially from distinct vendors) can leave gaps. Overlap is not much better: Duplicative capabilities mean organizations are wasting money and subjecting workers to alert fatigue. Meanwhile, this point-solution approach creates untenable complexity, forcing teams to navigate multiple interfaces and patching schedules. And as one recent study found, that complexity is a primary barrier to modernizing vulnerability management.4
Just as important, these point solutions are often built on those outdated assumptions. They try to plug holes in a non-existent perimeter, provide visibility into a stable infrastructure, and manage only predictable access.
Making Three Key Shifts
Overturning the three outdated assumptions is crucial for planning the path forward.
Focus on identity and trust
Organizations can no longer assume that users or devices within a network boundary are trustworthy. Instead, they should continuously validate identity and re-evaluate trust. Identity should be the consistent control layer across cloud, SaaS, hybrid environments, and APIs.
Implement continuous discovery
When infrastructure changes by the hour, monthly vulnerability scans are no longer sufficient. Successful organizations are implementing continuous visibility and discovery processes for applications, workloads, and environments. Doing so allows them to make updates before attackers discover new avenues into the network.
Enable flexible access
Unpredictable access requires more flexible access management systems. Organizations need to be able to make access decisions that incorporate context, such as device health, user location, and user behavior. And they need the ability to change decision-making logic as employee access needs evolve.
The Future Belongs to Adaptive Security
Businesses—and the technologies they rely on—are changing rapidly. Security must change at the same rate.
Organizations that continue optimizing for fixed perimeters, static infrastructure, and predictable behavior are putting themselves at risk. Rethinking traditional assumptions is critical. Building for perimeter-less enterprise, constantly changing infrastructure, and more unpredictable access can help organizations create a more adaptive strategy—which is essential for managing risk in a dynamic threat environment.
A: The traditional perimeter model assumes that employees work from corporate offices and access data housed in a single, localized data center. With this model, security teams can wall off the perimeter and prevent intrusions. But that model no longer works since organizations use cloud apps, support hybrid workforces, and need to access resources from everywhere.
A: Deploying an isolated tool for every new threat creates unsustainable management complexity. The average organization uses dozens of distinct security solutions, leading to security gaps, wasted budget on overlapping tools, and alert fatigue.
A: Adaptive security enables organizations to handle swiftly evolving requirements and threats. To make the move to an adaptive model, organizations must overturn traditional assumptions. They should focus on identity instead of perimeter protection, implement continuous discovery of IT environments, and enable flexible, adaptive access policies.
- Flexera, 2026 State of the Cloud Report, March 2026
- Mandiant, M-Trends 2026 Report, March 2026
- IBM with Palo Alto Networks, Capturing the cybersecurity dividend, May 2026
- KPMG, Balancing speed and safety: The CISO’s evolving role, May 2026
