The Moat and Drawbridge Fallacy
When medieval castles relied on moats and drawbridges, the defensive strategy was simple: control access at the perimeter, and everything inside is trusted. Network security followed the same logic for decades — firewalls at the edge, VPNs for remote access, and implicit trust for anything that got through. That model is dead, and the corpse is still twitching. The simultaneous escalation of credential-stuffing attacks, session-token hijacking, and identity-based lateral movement has exposed the fundamental flaw: the perimeter is not the network boundary, it is the identity. The relevant question is not whether your firewall is configured correctly. It is whether every authenticated session is continuously validated, and whether your identity provider can detect anomalous behavior before an attacker moves laterally.
[NEWS PEG 1 — NONE — REQUIRES VERIFICATION] Desk: insert today's primary development. Two sentences, factual, sourced.
[NEWS PEG 2 — NONE — REQUIRES VERIFICATION]
The Session-Token Blindspot
The most underreported attack vector in 2025-2026 is not password compromise — it is session-token theft. Modern authentication relies heavily on JWTs, OAuth tokens, and session cookies, and these tokens are often long-lived, poorly scoped, and transmitted over channels vulnerable to interception. [VERIFY: specific statistics on session hijacking incidents from Verizon DBIR or similar reports.] When an attacker steals a valid session token, they bypass MFA entirely because the token represents an already-authenticated session. The consequence is that multi-factor authentication, which was supposed to solve the password problem, is being circumvented by attacking the session layer instead.
The unseen implication is that most organizations have invested heavily in identity verification at login but have almost no visibility into session behavior after authentication. The gap between "who logged in" and "what they're doing now" is where the attacks are happening, and it is where most security teams have no detection capability.
[NEWS PEG 3 — NONE — REQUIRES VERIFICATION]
Counter-Argument: Zero Trust Is a Marketing Term, Not an Architecture
The skeptical case has teeth, and it deserves fair weight. "Zero Trust" has become a marketing buzzword that vendors apply to everything from firewalls to endpoint agents, diluting the concept until it means nothing. A security architect who has watched a decade of "this changes everything" announcements is not irrational to treat Zero Trust with caution. The gap between "Zero Trust as a principle" and "Zero Trust as a deployable architecture" is massive, and most organizations are stuck in the gap.
Where the skeptical case overreaches is in dismissing the underlying principle. Identity-centric security, continuous validation, and least-privilege access are not marketing — they are engineering requirements. The correct position is not "Zero Trust is useless" but "Zero Trust is a design principle that requires years of implementation, and most vendors are selling point solutions that claim to deliver it." Anyone briefing a board on this topic should present that distinction clearly rather than take a binary stance.
The Supply Chain Identity Crisis
Simultaneously, the SolarWinds and Log4j incidents exposed a deeper problem: identity and access management in the software supply chain. When a trusted vendor's build environment is compromised, the resulting binaries are signed with the vendor's own certificates, and the identity of the software is indistinguishable from legitimate releases. [VERIFY: specific SolarWinds and Log4j timeline details against published incident reports.] The consequence is that the identity of the software — who built it, what it contains, whether it's been tampered with — is now an attack surface, and most organizations have no mechanism to verify it.
The binding constraint is not the technology. It is the software bill of materials (SBOM): what components are in your software, where did they come from, and how do you know they haven't been compromised? These are not technical questions. They are supply-chain governance questions, and they are expensive to implement retroactively.
[NEWS PEG 4 — NONE — REQUIRES VERIFICATION]
The Perimeter-to-Identity Transition
The closest useful precedent is not the shift from on-premises to cloud. It is the shift from host-based security to network-based security in the 1990s. That cycle produced spectacular firewall deployments, massive corporate investment, and widespread adoption — followed by a reckoning when attackers realized that once they got inside the network, the firewall was irrelevant. [VERIFY: 1990s network security transition timeline against historical literature.] The lesson is not that firewalls were wrong. It is that the security model must evolve as the attack surface evolves, and the perimeter is always moving.
Identity security is in the same position. The technology is real and valuable, but the identity attack surface is the binding constraint, not the authentication mechanism. Organizations that treat this as a login problem will continue to burn capital on MFA deployments that don't address session security. Organizations that treat it as an identity-lifecycle problem — from provisioning to deprovisioning, from login to session termination — will capture the value.
[NEWS PEG 5 — NONE — REQUIRES VERIFICATION]
Counter-Argument: Passwordless Authentication Solves the Problem
The optimistic case for passwordless authentication — that FIDO2, WebAuthn, and passkeys eliminate the password problem entirely — is overstated. Passwordless authentication solves the password-compromise problem, but it does not solve the session-hijacking problem, the insider-threat problem, or the supply-chain identity problem. The claim that passwordless "solves" authentication is a category error: it shifts the problem from credentials to sessions, it does not eliminate it.
The workable resolution is layered identity security: combining passwordless authentication with continuous session validation, behavioral analytics, and identity governance. The organizations winning in this space are not those that deployed passkeys. They are those that deployed passkeys and implemented session monitoring, and built identity governance processes — and they are measuring the gaps, not assuming they're closed.
What To Do Before The Next Quarter
Start with session security, not login security. Implement short-lived tokens, continuous session validation, and anomalous behavior detection. MFA is necessary but not sufficient. Build the SBOM now. Document software components, their provenance, and their integrity verification. This is expensive to retrofit. Invest in identity governance. Implement automated provisioning and deprovisioning, periodic access reviews, and least-privilege enforcement. Treat passwordless as a component, not a solution. Deploy FIDO2 and passkeys, but also implement session monitoring and behavioral analytics. Budget for supply-chain security. Regulatory obligations are expanding. Systems deployed today must be designed for SBOM compliance tomorrow.
The Next Two Quarters
Forecast — analytical projection, not reporting. Expect the centre of gravity to keep moving from perimeter security to identity security. The most consequential developments over the next six months are more likely to be session-security tooling, SBOM compliance frameworks, and identity-governance automation than new firewall or MFA announcements. Watch for three signals: the emergence of standardized session-security metrics; the first meaningful regulatory enforcement actions against organizations with inadequate SBOM practices; and consolidation among identity-security vendors as the session-security problem turns out to be the commercially valuable one.
The organizations that come out ahead will be unglamorous. They will have completed an identity audit, built an SBOM, and implemented session monitoring. That is the whole advantage, and it is available now at low cost — which is precisely why deferring it will be difficult to defend later.