Cybersecurity in the Age of Hybrid Work: Securing the Perimeterless Office
28 September
For years, cybersecurity was built around a simple assumption: the office was the perimeter.
Users sat inside the corporate network. Applications lived in the datacentre. Firewalls protected the boundary. VPNs controlled remote access.
Then work changed.
Today, the corporate workforce might be sitting in an office in London, working from a home office in Manchester, accessing SaaS applications from a coffee shop or connecting from an airport lounge — all within the same working day.
The network perimeter didn’t disappear overnight.
It became irrelevant.
And yet many organisations are still trying to secure a modern workforce using security architectures designed for a world that no longer exists.
The office is no longer the network
The traditional security model was relatively straightforward.
Trust the network. Control the perimeter. Authenticate the user.
But hybrid working has fundamentally changed the relationship between users, devices, applications and data.
A user may access corporate resources without ever touching the traditional corporate network. Applications may be hosted entirely in the cloud. Employees may use personal devices or work from unmanaged locations. Third parties, contractors and suppliers may require access to systems.
The question is no longer:
“How do we protect our network?”
It is:
“How do we establish trust every time someone, or something, requests access?”
That is a much harder problem.
VPNs solved yesterday’s problem
VPN technology still has a role to play. But organisations can fall into the trap of treating VPN access as synonymous with secure access.
A VPN can establish an encrypted connection.
It doesn’t automatically tell you whether the device connecting to the network is secure.
Is it patched?
Is endpoint protection running?
Is the device compliant?
Has the user’s credentials been compromised?
Is the user behaving normally?
And, perhaps most importantly:
Does that particular user actually need access to that particular resource?
Authentication answers who are you?
Modern security needs to ask considerably more:
Should you be allowed to access this, from this device, in this context, right now?
The perimeterless office creates a different kind of risk
Hybrid working doesn’t necessarily make an organisation less secure.
It makes security assumptions more dangerous.
Consider an employee working remotely.
They authenticate successfully. Their credentials are valid. Their device has connected successfully.
Everything looks normal.
But what if the credentials were stolen?
What if the device is vulnerable?
What if malware is already present?
What if the user has suddenly started accessing systems they’ve never used before?
What if an attacker has compromised the endpoint but is quietly using legitimate credentials?
A security architecture that focuses primarily on keeping unauthorised people out can struggle when the attacker already has something that looks legitimate.
This is why modern security needs to move beyond the traditional perimeter and towards continuous verification and contextual security.
Zero Trust is more than a technology project
Zero Trust is often discussed as though it is simply another security product to deploy.
It isn’t.
At its heart, Zero Trust is a change in thinking:
Never assume that access should be trusted simply because a user or device has successfully crossed a particular security boundary.
Identity matters.
Device posture matters.
Application context matters.
Location can matter.
Behaviour matters.
Risk matters.
And those factors need to influence access decisions continuously.
For organisations transitioning towards a perimeterless workplace, this means bringing together technologies and processes that can answer a much more useful question:
“Is this access request appropriate given everything we currently know?”
Your endpoint is now part of your perimeter
When employees work outside the office, the endpoint becomes increasingly important.
It is effectively the user’s gateway into the organisation.
That makes endpoint detection and response more than simply an incident-response tool.
The ability to identify suspicious behaviour, investigate activity and understand what is happening across endpoints becomes an important part of maintaining trust in a distributed environment.
But there is a potential problem.
Deploying EDR isn’t the same as proving your EDR works.
An organisation can have excellent security technology deployed across thousands of devices and still have blind spots.
Can it detect an attacker moving laterally?
Can it identify credential abuse?
Can it detect techniques being used against its environment?
Can security teams investigate the activity quickly enough?
And what happens when an attacker behaves differently from the scenarios the organisation has previously considered?
These are questions that need to be tested rather than assumed.
Security controls need to be challenged
This is where threat emulation becomes particularly valuable.
Rather than simply asking:
“Do we have the right security controls?”
organisations can ask:
“If someone attacked us using realistic techniques, what would actually happen?”
Threat emulation can help organisations test security controls against realistic attack techniques and understand where detection, prevention or response capabilities may have gaps.
It changes the conversation from security expenditure to security assurance.
And that distinction matters.
Because a security control that exists on paper isn’t necessarily a security control that works when it matters.
The biggest hybrid-working vulnerability may be an assumption
The technology landscape is only part of the challenge.
Hybrid working has created a complicated ecosystem of people, devices, identities, applications, networks and third parties.
Security teams therefore need to challenge assumptions such as:
- “They’re authenticated, so they’re trusted.”
- “They’re connected through the VPN, so they’re secure.”
- “We’ve deployed EDR, so we’re protected.”
- “The firewall is configured correctly.”
- “The vulnerability scanner hasn’t found anything critical.”
- “That account has always had access.”
- “Our users know how to spot phishing.”
- “Our security controls worked last year.”
The uncomfortable question is:
When was the last time you actually tested these assumptions?
Hybrid working demands a different security mindset
The perimeterless office isn’t going away.
Neither is cloud adoption, remote working or the increasingly distributed technology ecosystem that supports modern organisations.
The organisations that adapt successfully won’t necessarily be the ones with the most security tools.
They’ll be the ones that understand how those controls work together — and regularly challenge whether they work as expected.
That means asking difficult questions.
Can we trust this device?
Can we trust this identity?
Why does this user need this access?
What happens if their credentials are compromised?
Would our security controls detect a realistic attack?
Where could an attacker move next?
And perhaps the most important question of all:
Are we protecting the organisation we actually have — or the organisation we designed our security around five or ten years ago?
Security without a perimeter requires continuous validation
The modern workplace doesn’t have a single front door.
It has thousands.
Users, devices, applications, cloud services, suppliers and identities are all potential routes into the organisation.
The answer isn’t necessarily to build a bigger wall around the network.
It’s to understand who and what is accessing the environment, why they need access, whether they can be trusted in that context, and what happens if that trust is compromised.
At ANSecurity, we help organisations move beyond simply deploying security controls to testing, validating and improving how those controls perform in the real world — from vulnerability management and attack-path analysis to threat emulation, endpoint security and network security.
Because in a perimeterless world, security isn’t a location. It’s an ongoing process of verification.
And the organisations that continually test their assumptions are better placed to understand where their real exposure lies.