Identity Is the New Security Perimeter: What This Week’s Zero Trust News Means for Business

Passwords, trusted networks and one-time security checks are losing ground. The latest identity and zero trust developments show that businesses now need to verify people, devices, applications and AI tools continuously.

Introduction

Over the past seven days, the technology and cybersecurity conversation has become increasingly focused on one issue: who or what is requesting access, and whether that access remains appropriate after the initial login.

New thinking from Google security engineers is pushing zero trust beyond its traditional boundaries. At the same time, passkeys are moving closer to the mainstream, security researchers are highlighting gaps in conventional MFA, and cybercriminal infrastructure is showing how cheaply attackers can operate at scale.

For small and mid-sized organisations, the message is practical rather than theoretical. You do not need to rebuild your entire network overnight. You do need to remove unnecessary trust, close overlooked access paths and make identity security part of everyday business operations.

1. Beyond Zero points to continuous verification

A recent industry analysis examined a Google-backed security concept called 'Beyond Zero'. The idea builds on zero trust but recognises that modern businesses have more than employees and laptops to secure. They also have cloud workloads, APIs, contractors, connected devices, software supply chains and increasingly capable AI agents.

Traditional zero trust is often summarised as never trust, always verify. Beyond Zero extends that principle by asking businesses to verify not only identity, but also context, intent and behaviour throughout a digital interaction. A user who authenticated successfully at 9 am may still present a different risk at 3 pm if their device changes, their location is unusual or their activity suddenly becomes inconsistent with their role.

This does not mean every small business needs an expensive artificial intelligence security platform. It does mean that a single login should not be treated as a permanent security approval.

Why it matters for businesses

For a growing organisation, access often expands faster than governance. A staff member may retain permissions after changing roles. A contractor may keep an account beyond the end of a project. A service account may have broad access because nobody knows which business process depends on it.

That creates risk well beyond data theft. Excessive access can increase the impact of ransomware, expose customer information, complicate insurance claims and make it harder to demonstrate reasonable security practices to clients or regulators.

The practical lesson from the Beyond Zero discussion is that identity security should be measured by what accounts can do in real conditions, not just by whether an MFA policy exists on paper.

What to do now

• Review your highest-risk accounts first, including administrators, finance users, executives, developers and external support providers.
• Set time limits and approval requirements for privileged access instead of allowing permanent administrator rights.
• Use sign-in risk, device health, location and unusual behaviour as signals for additional verification.
• Log access to critical systems and review alerts for impossible travel, unfamiliar devices and unusual download activity.
• Build a quarterly access review into management routines, with a named owner responsible for closing gaps.

For background, see the recent analysis of Beyond Zero.

2. Passkeys are gaining momentum, but IAM maturity still matters

Another major development this week was renewed attention on the decline of passwords. Reporting on guidance from the UK National Cyber Security Centre described the move towards passkeys and other passwordless authentication methods as a major change to decades of security practice.

Passkeys use cryptographic credentials stored on a trusted device or password manager. In many cases, the user confirms access with a fingerprint, face scan or device PIN. Unlike a password, the credential is designed to resist common phishing techniques because it is linked to the legitimate website or service.

The technology is promising, but implementation is not simply a matter of switching on a new login option. Businesses still need a reliable identity and access management foundation. They must know which systems support passkeys, how staff recover access when a device is lost, how contractors are enrolled and how administrators are protected during emergencies.

Why it matters for businesses

Small businesses are attractive targets because they often rely on email, cloud accounting, file-sharing systems and customer portals protected by passwords or basic MFA. A compromised password can provide access to several services, especially where employees reuse credentials or where single sign-on has been configured without strong supporting controls.

Passkeys can reduce phishing exposure and help simplify the user experience. They may also lower helpdesk costs associated with password resets. However, poorly planned recovery processes can create a new weak point. An attacker who can persuade a support person to reset an account may bypass the strongest authentication method.

The business case is therefore broader than replacing passwords. It is about creating a controlled lifecycle for identity, from onboarding through role changes, recovery and offboarding.

What to do now

• Identify the cloud services and business applications that already support passkeys or phishing-resistant MFA.
• Start with privileged users and administrators before rolling out new authentication methods to the entire organisation.
• Document secure account recovery procedures and require stronger checks for high-risk resets.
• Remove shared accounts wherever possible so that every action can be linked to an individual user.
• Keep at least one tested emergency access process, with strict monitoring and post-use review.

The reporting on the passwordless transition provides useful context, while the Microsoft Entra update for October illustrates how major platforms are connecting identity, endpoint, network and application signals.

3. MFA remains essential, but it cannot be the finish line

A recent security report highlighted a familiar but persistent problem: organisations may require MFA for Microsoft 365 and other major SaaS applications while leaving other access paths protected only by passwords.

Those gaps often sit in places that are easy to overlook. Examples include remote desktop services, virtual private networks, backup consoles, legacy applications, administrator portals, email forwarding tools, software development platforms and third-party remote support systems.

Attackers do not need to defeat the strongest control in an environment if they can find a weaker route around it. They may also exploit MFA fatigue, social engineering, session theft, OAuth consent abuse or account recovery procedures. In other words, a successful MFA prompt is one useful security signal, not proof that the person or process behind the session is trustworthy.

Why it matters for businesses

This is especially relevant for organisations that have grown through a mixture of cloud services, remote work and outsourced IT. A business may have excellent MFA coverage in its primary email platform but still expose a high-value system through an old VPN or an overlooked administrator account.

The consequences can include unauthorised payments, business email compromise, ransomware deployment and the theft of customer or employee data. In Australia, the reputational and reporting consequences can also be significant where a breach involves personal information or disrupts critical business services.

The priority is not to abandon MFA. It is to make MFA consistent, phishing-resistant where possible and supported by monitoring that can detect suspicious activity after authentication.

What to do now

• Create an inventory of every remote access route, not just the applications managed by your main identity provider.
• Disable legacy authentication protocols that cannot support modern security controls.
• Prefer phishing-resistant methods such as passkeys or hardware security keys for privileged accounts.
• Turn off push notification approval where possible, or use number matching and additional context to reduce MFA fatigue attacks.
• Alert on new MFA registrations, unusual recovery requests, suspicious OAuth grants and sign-ins from unfamiliar devices.

Read the recent report on MFA gaps for a practical reminder that identity protection depends on coverage across the whole environment.

4. Phishing infrastructure is scaling, making identity hygiene more urgent

A report published this week described the Yam Store, a cybercrime marketplace associated with more than one billion phishing messages. The scale is important because it shows how attackers can industrialise credential theft rather than rely on a small number of highly targeted campaigns.

Large phishing operations can imitate popular software, cloud services, login pages and business processes. They can also adapt quickly to current events, supplier relationships and familiar workplace routines. For a small organisation, the message may appear to come from a manager, accountant, customer or technology provider.

The risk is not limited to an employee typing a password into a fake website. Modern campaigns may attempt to capture session information, steal MFA codes, persuade users to approve a malicious sign-in or redirect them to a fraudulent payment process.

Why it matters for businesses

Smaller organisations frequently have fewer layers between a compromised account and a major business decision. One stolen finance login may expose payment details. One compromised administrator may provide access to email, shared files and backups. One hijacked supplier account may be used to impersonate a trusted partner.

Security awareness training remains useful, but it cannot be the only control. Employees are busy, attackers are convincing and genuine business messages often contain links, invoices and urgent requests. A resilient organisation assumes that some phishing attempts will succeed and limits what a compromised account can do.

What to do now

• Train employees to report suspicious messages without fear of blame, and make reporting available through a simple button or mailbox.
• Require secondary verification for bank detail changes, urgent payments and requests involving sensitive information.
• Use email authentication controls such as SPF, DKIM and DMARC, and monitor lookalike domains where practical.
• Restrict access to customer data, payment systems and backups using least privilege and separate administrator accounts.
• Test whether a compromised email account could reset other systems or approve a new MFA device.

The coverage of the Yam Store phishing operation is a useful prompt for reviewing both technical controls and payment verification procedures.

5. AI agents are becoming another identity category

The week’s zero trust discussions also placed growing attention on non-human identities. AI agents, automation tools and software services can now read documents, query systems, call APIs and take actions on behalf of users. That creates a security problem that traditional employee-focused IAM systems were not designed to solve.

Recent industry events and vendor announcements have focused on agent identity, runtime monitoring and autonomous identity governance. The direction of travel is clear: organisations will need to know which AI systems exist, what data they can access, which human or business process authorised them and what they are doing at runtime.

The risk is not limited to advanced enterprises. Small and mid-sized businesses are already using AI features in customer support, office productivity, marketing, accounting, software development and workflow automation. These features may be enabled by a vendor before the business has fully considered their permissions.

Why it matters for businesses

An AI assistant with access to a shared drive may expose confidential files through an overly broad prompt. An automation connected to email may forward sensitive information or act on a malicious instruction. A development tool with access to source code may create a supply chain or intellectual property risk.

The most important distinction is between a tool that suggests an action and an agent that can take one. The latter requires a more rigorous identity, approval and monitoring model.

What to do now

• Make an inventory of approved AI tools, connected applications, service accounts and automated workflows.
• Give AI tools the minimum permissions required for a specific business task, and avoid broad access to entire mailboxes or file shares.
• Require human approval for payments, account changes, external data sharing and other high-impact actions.
• Record which person, team or process authorised an automated identity and review that ownership regularly.
• Include AI and automation accounts in incident response exercises, access reviews and offboarding procedures.

The SecurityWeek zero trust and identity summit provides a useful overview of how security leaders are approaching human, machine and AI identities together.

What This Means For Your Business

The common thread across this week’s news is that identity has become the practical centre of cybersecurity. Zero trust is no longer just a network architecture project, and MFA is no longer a complete answer. Security depends on knowing who is accessing a system, what device or service is involved, what the request is trying to achieve and whether that access still makes sense.

For most small and mid-sized organisations, the best starting point is a focused identity review. List your critical systems, privileged accounts, remote access paths, third-party providers and automated tools. Then remove dormant accounts, reduce excessive permissions and protect the remaining high-risk identities with phishing-resistant MFA wherever possible.

Next, improve visibility. Make sure important sign-ins, privilege changes, MFA registrations, account recovery events and unusual data access are logged and reviewed. If your internal team cannot monitor these events, an experienced managed IT or security provider can help establish practical coverage without requiring a large in-house security department.

Finally, treat identity as an ongoing business process rather than a one-off technology project. Review access when people change roles, suppliers finish work or new AI capabilities are introduced. Small, consistent improvements can reduce the blast radius of a compromise, support compliance and protect the trust your customers place in your business.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.