Every vendor deck I have reviewed this year claims the perimeter is dead, and then proceeds to sell a new one. The uncomfortable truth from the incident response side is that most organizations who declare themselves “zero trust” have simply relocated their perimeter — from the firewall to the identity provider, the VPN concentrator, or the service mesh control plane. The attacker does not care where you moved it. They care that it is still a single membrane, and that once through it, lateral movement is quiet.
What Zero Trust Actually Asserts
Strip away the marketing and the model makes three claims. First, network location is not a trust signal: a packet arriving from the corporate LAN deserves no more credence than one from a coffee shop. Second, every request must be authenticated and authorized independently, with credentials that are short-lived and scoped to the specific resource. Third, the blast radius of any single compromised credential, workload, or device must be bounded by policy, not by hope.
Notice what is absent from that list: any particular product. Zero trust is an architectural posture, closer to a threat model than a deployment. When a team tells me they “bought zero trust,” my first question is what happens when a valid session token is stolen. If the honest answer is “the attacker has everything that user has, for eight hours,” you have a perimeter with better branding.
Where Real Deployments Quietly Regress
In post-incident reviews, the same regressions surface repeatedly. The identity provider becomes the new crown jewel, protected less rigorously than the old domain controllers ever were. Conditional access policies get carved with exceptions for legacy applications until the exceptions are the rule. Service-to-service traffic inside the cluster runs unauthenticated because “it’s east-west, it’s internal” — the exact reasoning zero trust was invented to kill.
Zero trust fails not at the architecture diagram, but at the fourth exception you grant to keep a legacy app alive.
The other quiet regression is session lifetime. Teams deploy phishing-resistant MFA at the front door, then issue refresh tokens valid for weeks. From an adversary’s perspective, a long-lived token is a password that never appears in a breach corpus and rarely triggers an alert when replayed. Continuous evaluation — re-checking device posture and behavioral signals during the session, not just at login — is the part of the model that most deployments defer indefinitely.
Signals That Your Model Is Working
Because zero trust is a posture, you validate it the way you validate any control: adversarially. The following tests tell you more than any compliance checklist.
- Steal a session token in a purple-team exercise and replay it from an unmanaged device. Measure whether anything notices.
- Disable a single workload identity and watch what breaks. If nothing does, that identity was over-scoped or unused.
- Trace one east-west request through your mesh and confirm authentication happened at each hop, not just at ingress.
- Count your policy exceptions quarterly. A rising count is a leading indicator of regression.
The Perimeter You Should Keep
None of this means throwing away network segmentation. Coarse network boundaries remain excellent at reducing noise, containing worms, and buying response time — they are just no longer a trust signal. The correct mental model is defense in depth with identity as the primary control and the network as a secondary brake. Segment aggressively, but never let a firewall rule stand in for an authorization decision.
The organizations that get this right share a habit: they treat every internal system as if it were internet-facing, because eventually, through some misconfiguration or stolen credential, it effectively will be. The perimeter is not dead. It has simply been demoted — from the thing you trust to one of several things you verify. Plan your architecture, your monitoring, and your incident response playbooks accordingly, and the marketing decks become irrelevant.