The Perimeter Is a Fiction — Intelligence Is the Boundary

The edge didn't move — it dissolved

There used to be a defensible shape to an enterprise network: offices inside, internet outside, a firewall between. That shape is gone. Branch offices run on broadband and LTE failover. Employees work from networks you will never see. Critical workloads sit in SaaS tenants owned by third parties, and half the devices that matter — ATMs, kiosks, cameras, sensors — were never 'inside' anything.

Yet a surprising amount of security and operations thinking still assumes the perimeter exists. It shows up in small ways: monitoring that only covers the data centre, access rules that trust the office network, and incident reviews that begin with 'was it internal or external?' — a question that no longer means anything.

Behaviour is the new boundary

If you cannot draw a wall around the estate, the alternative is to know what normal looks like inside it — and to notice deviation fast. That is an intelligence problem, not a firewall problem.

In practice it means every device, session and flow produces telemetry; the telemetry lands in one place with one identity model; and 'unusual' is defined per device class and per site, because a branch router and an ATM have very different ideas of normal. The organisations doing this well can answer questions that perimeter-thinking cannot even frame: which branches changed behaviour this week, which device is talking to something it has never talked to, which credential is being used from two geographies at once.

Why this is an operations story before a security story

The same instrumentation that spots anomalies also runs the estate better. A unified behavioural view of every branch device tells you which sites flap every monsoon, which UPS units are ageing out, and which circuits degrade every evening at peak — long before any of it becomes an incident or a breach.

This is why we treat infrastructure intelligence as one discipline: the data that protects the network and the data that operates it are the same data. Splitting them into separate tools and teams is how organisations end up paying twice and seeing half.

A pragmatic starting sequence

• Enumerate everything — a live inventory of every device at every site, because you cannot instrument what you have not counted.
• Centralise telemetry with one identity per device — site, class, circuit and owner attached to every event.
• Define normal per device class, then alert on deviation — not on static thresholds copied from a vendor whitepaper.
• Close the loop into the service desk — an anomaly should open an enriched ticket, not an email somebody reads tomorrow.