Identity-first security economics are overtaking perimeter models for MSPs

At a glance

What this is: This is an MSP-focused analysis of why traditional perimeter security now costs more while identity-driven attacks account for most of the breach path.

Why it matters: It matters because IAM, PAM, and NHI teams need to treat access control as the primary control plane for remote work, application access, and lateral-movement risk.

By the numbers:

• 22% of breaches started with stolen or compromised credentials.
• 60% of breaches involved human factors, credential misuse, errors, or social engineering.
• 88% of web app breaches used stolen credentials.

Context

The security model MSPs inherited was built around the network edge: trust the internal network, defend the perimeter, and treat remote access as an exception. That model breaks when users, apps, and workloads no longer live behind a single boundary and when identity, not the network path, becomes the point of compromise.

JumpCloud’s article frames this as an economics problem as much as a security problem. The central governance issue is that organisations keep funding controls for a perimeter that no longer maps to how access is actually granted, monitored, and abused in modern environments.

For identity programmes, the implication is straightforward. If the attacker enters through credentials, MFA gaps, or over-broad application access, then the control investment has to move to issuance, authorization, and session governance rather than to edge containment alone.

Key questions

Q: How should MSPs reduce password risk across both their own staff and client environments?

A: MSPs should centralise password governance, enforce strong policy controls, and limit standing access across tenants. A practical programme combines role-based permissions, delegated administration, auditing, and secure sharing so access is visible and revocable. The goal is to reduce credential sprawl, improve accountability, and make password hygiene measurable across the managed service lifecycle.

Q: Why do perimeter tools deliver less value against identity-led breaches?

A: Because perimeter tools judge traffic at the boundary, while identity-led breaches use legitimate authentication and then behave like normal users. Once the attacker is inside the session, the network layer often sees routine activity rather than malicious intent.

Q: What breaks when VPN-based remote access is the default for OT?

A: VPN-based access often grants broader network reach than the task requires, which expands the attack surface and makes lateral movement easier. It also tends to preserve standing access instead of limiting sessions to the maintenance window or emergency use case. The breakage is not just technical, it is governance failure through overexposure.

Q: Should organisations prioritise ZTNA or deeper identity governance first?

A: They should do both, but identity governance should define the access scope and ZTNA should enforce it. ZTNA without entitlement discipline simply moves broad access into a different tunnel, while governance without enforcement leaves the same exposure in place.

Technical breakdown

Why perimeter controls miss credential-led attacks

Perimeter controls such as firewalls and VPNs were designed to decide whether traffic could enter a network boundary. Credential-led attacks bypass that boundary by using legitimate authentication paths after initial access. Once an attacker has a valid account, the traffic looks normal to a network stack even when the session is malicious. That is why identity, not packet origin, becomes the more relevant trust signal in cloud, SaaS, and remote-work environments. The technical failure is not that firewalls stop working, but that they are operating at the wrong layer for the dominant attack path.

Practical implication: Shift detection and authorization logic from network entry points to identity events, session state, and application-level access decisions.

How Zero Trust Network Access changes the access model

Zero Trust Network Access, or ZTNA, moves access from network reachability to per-application authorization. Instead of placing a user on the network and trusting internal movement, ZTNA brokers access to specific resources after verifying identity, device, and policy conditions. This reduces the exposed attack surface because a stolen credential does not automatically grant broad network visibility. In practice, ZTNA is less about replacing one access tunnel with another and more about changing the trust unit from the subnet to the application session.

Practical implication: Use ZTNA to narrow standing network reach and make application access conditional on identity and policy signals.

Why least privilege becomes the economic control

Least privilege matters here because the economic loss from a compromised credential scales with the access attached to that credential. If an attacker signs in with legitimate credentials but can only reach one application or one function, the blast radius stays smaller and response costs fall. The article’s cost argument is therefore not just about replacing old infrastructure, but about reducing the value of any single stolen identity. That is why access scope, not just access method, determines the security return on spend.

Practical implication: Review application entitlements and privileged access boundaries before investing further in perimeter tooling.

Threat narrative

Attacker objective: The objective is to turn valid access into broader application reach while remaining indistinguishable from legitimate users to perimeter tools.

1. Entry occurs through stolen or compromised credentials, which lets the attacker authenticate through normal user channels instead of attacking the perimeter directly.
2. The attacker abuses legitimate access to move laterally, because the session appears like ordinary user activity to network-focused tools.
3. Impact follows through broader application exposure, support overhead, and reduced detection value when controls are concentrated at the edge rather than at identity checkpoints.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Codefinger S3 ransomware 2025: Codefinger used victims' compromised AWS keys to re-encrypt S3 buckets with SSE-C, set 7-day deletion and demanded ransom for the key.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity, not the perimeter, is now the control plane that determines breach cost. The article is right to frame perimeter defence as an economic mismatch, because stolen credentials now open the door more often than direct network exploitation. When access itself is the attack path, spending more on edge infrastructure buys diminishing returns. Practitioners should judge control effectiveness by how tightly identity sessions are scoped, not by how much network hardware surrounds them.

Credential-led attacks expose a governance gap that firewall budgets cannot close. Firewalls and VPNs still have a role, but they do not solve authorization after authentication. That gap is where identity governance, privileged access control, and application-level enforcement belong. The practical conclusion is that MSP security strategy must reallocate effort from perimeter maintenance to access lifecycle control.

Least privilege is the new economic lever for managed environments. The article’s cost model is not just about reducing spend, it is about reducing the blast radius that makes spend worthwhile in the first place. When a stolen identity can only reach a narrow application slice, the attacker’s value drops sharply. That makes entitlement design a financial control as much as a security one.

Identity-first security economics favour controls that compress trust assumptions. ZTNA, granular authorization, and better access governance are not interchangeable features, but they all reduce the amount of implicit trust attached to a valid login. That matters because the article’s central claim is about economics: controls should be measured by how much attacker usefulness they remove per dollar spent. MSPs should treat broad network reach as a cost liability, not a default service level.

Perimeter-first operating models are accumulating identity trust debt. The longer organisations continue to defend a network boundary while granting broad access inside it, the more they pay to protect the wrong thing. That debt shows up as support overhead, slow incident response, and residual risk after credential compromise. The programme implication is to re-centre access governance on who can reach what, under which conditions, and for how long.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Read next: Guide to NHI Rotation Challenges

What this signals

Identity trust debt: organisations that keep funding perimeter defences while granting broad internal access accumulate a control gap that shows up only after credentials are compromised. The practical issue is not just detection speed, but the amount of reach a valid login can still buy.

Perimeter models assume the network boundary is the main place to stop intrusion, yet identity-led attacks often arrive through legitimate authentication paths. That means access governance, privilege scope, and session controls now matter more than another layer of edge inspection.

The most useful migration signal is whether your programme can answer a simple question: after a login, how far can that identity actually go? If the answer is broadly, the access model is still too close to the perimeter era.

For practitioners

• Re-map security spend to access risk Identify where firewall, VPN, and segmentation spend is protecting low-value network boundaries while credential-led access remains broad. Reallocate review time toward application entitlements, privileged access, and session-level policy enforcement.
• Limit network reach with ZTNA Pilot per-application access for remote users and new cloud apps so that authentication grants only the minimum session needed. Use the rollout to retire broad VPN assumptions rather than duplicating them in a new form.
• Tighten privileged access boundaries Review which admin and service credentials can reach multiple systems after login, then collapse those scopes to task-specific access paths. Treat any credential that can move laterally as a high-cost risk concentration.
• Measure identity over perimeter exposure Track how many critical systems still depend on broad network access instead of application-level authorization, and use that count to prioritise migration. The goal is to shrink the attack surface that a valid login can reach.

Key takeaways

• The core risk is not that perimeter controls stopped working, but that they now protect a boundary that attackers bypass with valid credentials.
• The article cites breach data showing credential-led attacks are common, which supports shifting control investment toward identity and access governance.
• Practitioners should compress access scope, use ZTNA where appropriate, and treat entitlement design as a cost and risk control.

Key terms

• Identity-first security: Identity-first security is an approach that treats identity as the primary control plane for managing risk. Instead of relying mainly on network or endpoint boundaries, it uses identity context to decide what can happen, when it can happen, and under what conditions. That model is especially relevant where privileges move across human, non-human, and agentic actors.
• Zero Trust Network: A Zero Trust Network is a network security approach that does not trust users, devices, or traffic by default. Every connection is continuously verified using identity, device posture, context, and policy before access is granted. It assumes breach, limits lateral movement, and treats network access as conditional rather than implicit.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Action Scope: Action scope is the set of outcomes an AI system is permitted to trigger based on its granted access and task context. In agentic environments, it is a better control target than simple account permission because it reflects what the system can actually do with data, tools, and timing.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.