Midmarket security teams need architecture, not enterprise hand-me-downs

At a glance

What this is: This analysis argues that midmarket security teams are being forced to manage enterprise-style risk with fragmented tools, and that access architecture is the missing control layer.

Why it matters: It matters because IAM, NHI, and security architecture teams need controls that reduce exposure and verification gaps without adding operational overhead that midmarket teams cannot absorb.

Context

Midmarket security programmes often fail at the access layer before they fail in detection or response. When teams rely on VPNs, scattered application logins, and manual exposure tracking, they lose sight of who can reach internal systems and under what conditions, which turns visibility into an assumption instead of a control.

Pomerium’s article frames this as an architectural mismatch: midmarket organisations are being asked to run enterprise-grade access governance with tools that assume larger teams, deeper budgets, and more operational tolerance. The central issue is not a lack of security intent, but a design that makes continuous verification hard to sustain.

The article also extends the problem into agentic workflows, where AI agents need scoped identities, request-level policy, and auditability just like human users. That moves the question beyond remote access and into non-human identity governance across internal applications and APIs.

Key questions

Q: What breaks when midmarket teams rely on VPNs for internal application access?

A: VPNs break the visibility model by granting broad network reach after a single authentication event. That makes it hard to know which internal applications, services, or data sources are actually reachable under current conditions. The result is an access assumption that looks secure at login time but is weak at request time.

Q: Why does fragmented access management make zero trust harder in midmarket environments?

A: Fragmented access management forces teams to reason about identity, device posture, and application exposure across separate tools. That increases the chance that one control says access is fine while another shows the environment is already overexposed. Zero trust becomes harder because the policy decision is no longer anchored in one consistent enforcement point.

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: When should organisations move from manual recertification to automated access reviews?

A: Organisations should move as soon as manual recertification starts slowing down approvals, creating inconsistent decisions, or leaving too little time before audit deadlines. Automation is especially justified when the same users must be reviewed across SAP and multiple connected applications. At that point, workflow standardisation, risk scoring, and faster remediation materially improve control quality.

Technical breakdown

Why fragmented access stacks create blind spots

A fragmented access stack creates blind spots because each tool sees only part of the identity and request path. VPNs grant broad network reach after a single authentication event, while application-specific logins and manual reviews leave no unified view of what is exposed. In practice, that means the organisation can be confident about authentication while remaining uncertain about authorisation, context, and actual reachability. The problem is architectural: the control boundary sits too far from the resource, so the team cannot continuously verify access at the point of use.

Practical implication: move access decisions closer to the application or workload so visibility and authorisation are enforced per request, not inferred after the fact.

How continuous verification changes zero trust access

Continuous verification shifts access from a one-time grant to an always-evaluated decision. In a zero trust access model, identity, device posture, group membership, and request context are checked at the moment of access rather than assumed to remain valid after login. That matters in midmarket environments because exposure changes faster than manual review cycles can follow. It also helps reduce the operational drift that appears when teams stitch together multiple tools to cover one access path. The control is not just authentication, but ongoing policy enforcement around each request.

Practical implication: require request-level policy checks for internal applications so exposure can change without waiting for a manual recertification cycle.

What policy-as-code means for non-human identity access

Policy-as-code turns access rules into version-controlled policy that can be audited, repeated, and applied consistently across humans and non-human identities. For AI agents and service accounts, that matters because access must be scoped to a task, logged, and constrained by context rather than inherited from a broad role. The article’s MCP reference points to a growing reality: agentic systems will connect to internal tools and data, and they will need the same identity-aware guardrails as people. That is an NHI governance problem as much as an access problem.

Practical implication: define explicit policy for AI agents and other NHIs before they reach internal systems, rather than inheriting human access patterns.

Breaches seen in the wild

• iOS apps leaking hard-coded secrets: Cybernews found 71% of 156,080 iOS apps leak hard-coded secrets, with open cloud storage and Firebase databases exposing user data.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Midmarket security is primarily an architecture problem, not a staffing problem: the article’s core signal is that budget growth does not automatically fix exposure when the access layer remains fragmented. Midmarket teams can add tools and still fail to see who can reach what, because visibility is split across VPNs, applications, and manual review processes. The practitioner conclusion is that architectural simplification has to precede tool accumulation.

Continuous verification is the control boundary that midmarket teams are missing: one-time authentication does not answer whether access is still appropriate at the moment of use. That gap matters more as environments mix humans, service accounts, and AI agents, because each request can carry different context and risk. The implication is that access governance must operate at request time, not just at login time.

Policy-as-code is becoming a governance requirement for both human and non-human access: the article shows why repeatable rules matter when teams are too small to manage exceptions manually. For NHIs and AI agents, static role assignment is a poor fit because the access needed is often task-scoped and ephemeral. Practitioners should treat policy as the durable control plane for identity decisions.

Midmarket zero trust must be built for operational reality, not enterprise idealisation: large-suite designs assume extra staff, extra tuning, and extra tolerance for complexity, which midmarket teams often lack. That is why identity-aware reverse proxy patterns resonate here: they collapse multiple access concerns into a simpler enforcement point. The field should read this as a demand for architecture that reduces governance drag rather than redistributing it.

Agentic access will expose the same governance weaknesses faster than human-only access did: the article correctly extends the access discussion to AI agents, which need identities, scoped permissions, and audit trails before they touch internal systems. The governance lesson is that NHI controls and zero trust access are converging, not separate workstreams. Practitioners need one access model that can handle users, workloads, and agents together.

What this signals

Identity-aware access is becoming the stabilising layer for midmarket programmes: the article shows why teams that cannot absorb enterprise complexity still need stronger control over who can reach internal resources. That pushes access architecture ahead of traditional point solutions, because the enforcement model has to be simpler than the stack it governs.

Midmarket governance now has to span humans, workloads, and AI agents: the access problem no longer stops at employee login. As agentic systems start touching internal tools, the same identity model must handle user access, service access, and task-scoped non-human access without creating separate governance silos.

Policy-as-code is the practical way to keep access auditable at midmarket scale: rules that can be versioned, reviewed, and enforced consistently reduce the operational burden on small teams. That makes access governance more durable than manual exception handling, especially when the environment is changing faster than recertification cycles can keep up.

For practitioners

• Standardise request-level access enforcement Move internal application access decisions to a control point that evaluates identity and context on every request instead of relying on broad VPN reach after login.
• Replace manual exposure tracking Inventory internet-facing assets and internal access paths in one governed view so exposure can be assessed without spreadsheet-driven gap analysis.
• Define policy for AI agent identities Assign scoped permissions, audit logging, and explicit access boundaries before AI agents connect to internal tools, databases, or APIs.
• Reduce access-stack fragmentation Consolidate overlapping access controls that force teams to maintain separate policies for network entry, application login, and exception handling.

Key takeaways

• Midmarket security teams are not short on ambition or spend, but many still lack an access architecture that gives them reliable visibility into exposure.
• The article’s central evidence is operational strain, not just sentiment, with fragmentation and slow exposure assessment showing where current models fail.
• Continuous verification and identity-aware enforcement are the controls that change the equation because they reduce reliance on broad network trust and manual review.

Key terms

• Continuous Verification: A Zero Trust practice that re-evaluates trust during the session instead of relying on a single successful login. The control is stronger when context signals are available in real time and when the identity programme can act on those signals without creating excessive exceptions.
• Identity-Aware Access: Identity-aware access is an authorization model that evaluates who or what is making a request, what it is trying to reach, and under what context. It replaces broad, persistent trust with request-level decisions. In agentic environments, it is the control that can contain a deceived agent before it reaches enterprise systems.
• Policy as Code: Policy as code stores authorization logic in version control and evaluates it through testable, reviewable rules. For agent governance, it makes runtime decisions reproducible and measurable, which is critical when actions can be triggered by untrusted content and executed at machine speed.
• Midmarket security architecture: The design approach used by organisations that are too large for lightweight consumer-style tools but too small to run complex enterprise stacks well. It focuses on reducing operational burden while preserving strong governance over access, visibility, and response.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.