Think about how a well-run hotel handles security. Anyone can walk through the front door, because that’s not where protection lives. Your keycard opens your room and does nothing else. The lift only stops on your floor. The master key stays locked away, and every use is logged. And if a card suddenly starts opening doors on three different floors at 3 am, someone at the front desk notices. 

Now imagine a hotel that only guards the lobby. Get past reception and every door opens. That’s still how plenty of organisations run their networks, and attackers know it. They’ve stopped knocking on the front door. They’re using the key. 

Sophos found that 67% of the incidents its response teams investigated last year were rooted in identity-related attacks. [1] Verizon’s 2026 DBIR shows credential abuse appearing in 39% of breaches once you look across the whole attack chain, not just the first step in. [2] Half of the ransomware victims in that report had a credential or infostealer event in the 95 days before the attack. [3] 

Here’s the uncomfortable part. Most of these organisations weren’t running without identity control. In SANS’ 2026 survey, 85% had ITDR tools deployed, yet 55% still experienced an identity-related breach in the past 12 months. [4] The tools were there. The model underneath them was the problem: it was built for a network perimeter that barely exists anymore. 

Identity-first security is the hotel model applied to your systems. Every key is limited to what it needs, master keys are locked down, and someone is watching for keys that start behaving strangely. 

What Is Identity-First Security, and Why Did the Perimeter Collapse? 

For years, the network was the boundary. Get onto the office network or the VPN, and you are mostly trusted. That worked when people, apps, and data all lived in one place. 

They don’t anymore. Staff work from home; apps live in the cloud; contractors connect from their own devices, and services talk to each other through APIs. NIST’s zero trust guidance puts it plainly: no implicit trust should be granted based solely on network location or asset ownership, and defences shift from network segments to the resources themselves. [5] 

Identity-first security takes that to its logical end. If the network can’t tell you who to trust, identity has to. Every user, device, service account and AI agent proves who it is, and gets only what it needs, every time. 

Zero Trust Is the Strategy. ZTNA Is How You Deliver It. 

Zero trust is the principle: never trust, always verify. Zero Trust Network Access (ZTNA) is one of the most practical ways to apply it. A VPN drops a user onto the network. ZTNA connects them to specific applications after checking who they are and how healthy their device is, then keeps checking. 

The difference shows up when a credential gets stolen. On a VPN, that one login can open the door to everything on the network. With ZTNA, it only reaches the apps its owner is allowed to use, and only while their device passes the checks. Attackers who get in find far less to move around in. 

The data backs this up. Expel found that 52.3% of the identity incidents it investigated involved stolen credentials that were blocked by existing controls like conditional access and device compliance. [8] The controls work when they’re in place. 

Every access request gets four questions: 

• Who is asking? User identity, confirmed with MFA. 

• Is the device healthy? Managed, patched and compliant. 

• What do they need? One specific application, not the whole network. 

• Does it still look right? Checks continue through the session, not just at login. 

The major platforms take slightly different routes to the same goal: 

• Trend Micro: Zero Trust Secure Access draws on Trend Vision One’s telemetry across email, cloud, networks and SaaS to drive automated access control. [9] 

• Palo Alto Networks Prisma Access: cloud-delivered ZTNA that combines least-privilege access, continuous trust verification and ongoing security inspection. [10] 

• Fortinet: ZTNA built into FortiGate and FortiClient, with zero trust tags applied through FortiClient EMS. Access is granted only after device verification, user authentication and posture checks. [11] 

• Zscaler: Zscaler Private Access connects users directly to specific apps rather than the network, to reduce the attack surface and limit lateral movement. [12] 

Choosing between them isn’t about the longest feature list. It’s about how well each fits your identity provider, your device estate and the team that has to run it day to day. As a rough guide, Trend Micro suits teams already on Vision One, Fortinet suits organisations already running FortiGate, and Zscaler and Prisma Access are cloud-delivered, so there’s no extra hardware to get started. 

PAM and ITDR: The Next Layer 

Once access is tightly controlled, two more layers do the heavy lifting. 

Privileged Access Management (PAM) locks down the accounts that can do the most damage, like admins, root users and service accounts. Vaulting credentials, granting access just in time and recording sessions mean a stolen password doesn’t automatically become a stolen environment. 

Identity Threat Detection and Response (ITDR) watches how identities behave and flags when a trusted account starts acting like an attacker. Gartner’s March 2026 research describes traditional IAM as essential but primarily preventative, and not designed for attacks that use existing identities. [6] Speed matters here: SANS found 68% of organisations detect identity attacks within 24 hours, but only 55% contain them in that window. [4] 

Non-human identities add to the pressure. CyberArk’s 2025 research found 82 machine identities for every human, with 42% of them holding privileged or sensitive access. [7] 

ITDR works best on a solid access foundation. For many organisations, that means getting zero trust access right first. 

What “Doing This Well” Actually Looks Like 

Organisations ahead of the curve share a few habits: 

• They verify every access request, not just login. Device health and behaviour count, and access is per application, not network-wide. 

• They vault and time-limit privileged access, so admin rights aren’t sitting around waiting to be stolen. 

• They inventory non-human identities and rotate their credentials on a schedule. 

• They close the MFA gaps. Sophos found that MFA was missing or failing in 59% of the cases it analysed. [13] 

• They feed identity signals into detection, so “was this account misused?” gets answered in minutes, not days. 

None of these are exotic. It’s mostly about building identity into the architecture early, rather than bolting it on after an incident. 

How Mitrais Approaches Identity-First Security 

Identity-first security is a practice, not a product you switch on. So we start with the basics: where does access sit today, who (and what) holds it, and where are the gaps? 

As a partner of Trend Micro, Palo Alto Networks and Fortinet, Mitrais supports clients from assessing vulnerabilities, through integrating the right tools, to training their teams to run them. In practice, that looks like this: 

• Assess first. We consult and assess gaps, then recommend the best-fit solution before any product decision is made. 

• Deploy Zero Trust. We help deploy Zero Trust with Trend Micro, so only verified users can reach critical resources. The same applies with Palo Alto Networks and Fortinet. 

• Build your team’s capabilities. We focus on empowering your internal team to manage the framework confidently, rather than offering round-the-clock monitoring. 

• Fix the legacy problem. Older applications often lack modern security features. As a software development company, we can modernise them through a secure development process. 

Our team is ISO 27001 certified, and that standard shapes how we set up and maintain these environments. 

The useful question for any security partner isn’t “Do you support zero trust?” It’s “What will you help my team do on day one, and what can they run themselves by day ninety?” 

If you’d like to see where your organisation stands, book a free consultation with the Mitrais cybersecurity team or explore our cybersecurity services. 

The Bottom Line 

The perimeter isn’t coming back. What protects an organisation now is knowing, continuously, who and what is accessing its systems, and what that identity can reach if it’s compromised. 

“Do we have MFA?” is no longer the right question. Try “What could a stolen identity reach, and how fast would we know?” 

Want to talk about how identity-first security works in practice? Get in touch with us today!

Sources 

1. Sophos Active Adversary Report 2026 press release: https://www.sophos.com/en-us/press/press-releases/sophos-active-adversary-report-2026-identity-attacks-dominate-as-threat-groups-proliferate 
2. Verizon 2026 DBIR, via SpyCloud summary: https://spycloud.com/blog/top-takeaways-from-the-2026-verizon-data-breach-investigations-report/ 
3. Verizon 2026 DBIR, via Flare summary: https://flare.io/learn/resources/blog/2026-verizon-dbir 
4. SANS 2026 ITDR Report: https://www.sans.org/research/identity-threat-detection-response-report 
5. NIST SP 800-207: https://csrc.nist.gov/Pubs/sp/800/207/Final \
6. Gartner (5 March 2026, ID G00845676), as quoted by Stellar Cyber: https://stellarcyber.ai/iam-protects-the-identity-itdr-protects-the-moment/ 
7. CyberArk 2025 Identity Security Landscape: https://www.businesswire.com/news/home/20250423817886/en 
8. Expel 2026 Annual Threat Report: https://expel.com/cyberspeak/identity-based-attacks/ 
9. Trend Micro newsroom (AU): https://www.trendmicro.com/en/about/newsroom/local-press-releases/au/2021/2021-06-16.html and Trend research page: https://trendmicro.com/en_ca/research/23/l/web-security-expands-into-secure-service-edge-sse.html 
10. Palo Alto Networks Prisma Access: https://www.paloaltonetworks.com/prisma/ztna 
11. Fortinet docs: https://docs.fortinet.com/document/fortigate/7.0.0/administration-guide/855420 
12. Zscaler Private Access: https://www.zscaler.com/powered-by-you 
13. Sophos report coverage (MFA gaps): https://tiinside.com.br/en/12/05/2026/ataques-de-identidade-ja-sao-origem-de-67-dos-incidentes-ciberneticos/ 
14. Mitrais, Trend Micro Cybersecurity: https://www.mitrais.com/software-product/trend-micro-cybersecurity/ 
15. Mitrais, Palo Alto Cybersecurity: https://www.mitrais.com/software-product/palo-alto-cybersecurity/