Security & Identity Modernization

Why Security Modernization Is Urgent in 2026

Three forces are accelerating security modernization in 2026: AI lowers the cost of phishing and impersonation, SBOM expectations are spreading through federal and enterprise procurement, and standing privileges let attackers move laterally quickly.

AI-Powered Attack Automation

Threat actors can use LLMs to generate personalized phishing emails at scale, and deepfake video has already been used to authorize a real wire transfer (Arup, about $25M, 2024; CNN via ABC17). FIDO2/Passkeys are the most widely deployed phishing-resistant authentication; SMS and app-based MFA can be bypassed in real time by adversary-in-the-middle proxies. Phishing-resistant MFA on privileged accounts is a widely recommended baseline; check what your insurer and regulators currently require.

Supply Chain & Software Bill of Materials

Following SolarWinds, Log4Shell, and XZ Utils backdoor incidents, US federal procurement guidance and some enterprise procurement standards have pushed software suppliers toward Software Bill of Materials (SBOM) generation and secure-development attestations. NIST SP 800-218 (Secure Software Development Framework) is a common reference. Requirements differ by contract and have changed over time, so confirm what applies to your contracts and insurers before scoping SBOM work.

Privileged Access & Lateral Movement

Attackers can move quickly after initial access; CrowdStrike reports a 29-minute average eCrime breakout time in 2025 (CrowdStrike). That speed is helped by "standing privileges" - service accounts and admin accounts with permanent, always-on access to sensitive systems. Privileged Access Management (PAM) eliminates standing privileges through just-in-time (JIT) access: accounts receive elevated permissions for specific tasks and specific time windows, then lose them automatically. PAM products from vendors such as CyberArk, BeyondTrust, and Delinea aim to reduce lateral-movement risk; ask each vendor for evidence from a deployment comparable to yours.

Assessment: Evaluating Your Security Posture

A security modernization assessment should start with identity - it is the control plane for everything else.

1 Identity Inventory

Enumerate all identity providers: on-premises AD forests, Entra ID tenants, Okta orgs, legacy LDAP directories, and application-local user databases. Each identity silo is a potential attack surface. Map all service accounts (non-human identities), shared accounts, and privileged accounts. Service accounts are the most dangerous: they typically have no password rotation, broad permissions, and no human owner reviewing their activity.

2 Legacy Protocol Audit

Identify all applications using NTLM, Kerberos, Basic Authentication, POP3, IMAP, and SMTP without OAuth. Microsoft's Entra ID now blocks Basic Auth by default; applications using it are already failing or working through legacy exceptions that Microsoft is removing. Each legacy protocol is a gap in your MFA coverage - an attacker who steals a password can authenticate without triggering MFA if Basic Auth is available.

3 Access Entitlement Review

Run an access review across all critical systems. For each account, determine: Is this person still employed? Do they still need this level of access for their current role? When was this access last certified? Organizations without automated access reviews accumulate "access creep" where former employees retain access and current employees accumulate permissions from previous roles. IGA tools (SailPoint, Saviynt) automate this continuously.

4 Network Perimeter vs. Application Access

Map every application that is protected only by network perimeter (VPN access grants access to the entire subnet containing the application). These are your Zero Trust migration candidates - replace VPN-based application access with ZTNA (Zscaler Private Access, Cloudflare Access, Prisma Access) where the user authenticates to the specific application, not to a network segment.

Zero Trust Implementation: The Three Pillars

Zero Trust is not a product - it is an architecture requiring three simultaneous pillars. Buying only one does not produce Zero Trust.

Pillar 1: Identity (Who are you?)

Start here

Replace on-premises Active Directory as the primary identity provider with Entra ID or Okta. Enable Conditional Access policies: block sign-ins from high-risk locations, require MFA for all privileged operations, enforce phishing-resistant FIDO2 authentication for administrators and sensitive roles. Implement Identity Governance (IGA) for automated access reviews and JIT privileged access.

Investment: $150K–$400K. Timeline: 6–12 months. ROI driver: Eliminates the most common initial access vector (credential theft + password spray).

Pillar 2: Device Trust (Is your device healthy?)

Most skipped, highest impact

Conditional Access without device health signals is incomplete. An attacker with stolen credentials from an unmanaged device passes MFA but their device is not enrolled in Intune/MDM, has no EDR agent, and has no compliance policy applied. Entra ID's Conditional Access can require "compliant device" (Intune-enrolled, up-to-date OS, antivirus active) as a sign-in condition - blocking authentication from unmanaged or compromised endpoints entirely.

Investment: $80K–$200K. Timeline: 3–6 months. ROI driver: Stops session hijacking where attacker injects into an authenticated session from a new device.

Pillar 3: Network Access (Can you reach only this app?)

VPN replacement

Replace VPN with Zero Trust Network Access (ZTNA). VPN grants access to a network segment; ZTNA grants access to a specific application after verifying identity AND device health. Even if an attacker compromises credentials and a device, they can reach only the specific application authorized - not the entire internal network. Zscaler Private Access, Cloudflare Access, and Microsoft Entra Private Access are the leading ZTNA platforms.

Investment: $200K–$400K. Timeline: 6–12 months. ROI driver: Eliminates lateral movement after initial compromise. Also eliminates expensive MPLS/VPN infrastructure costs.

Risk Factors & Common Failure Modes

Zero Trust programs fail in four recurring ways: buying identity tools before defining architecture, leaving legacy-protocol exceptions that bypass MFA entirely, centralizing on one IdP with no break-glass fallback, and leaving Conditional Access in report-only mode indefinitely instead of enforcing it.

Tool-First, Strategy-Second

The most common failure: buying Okta, Zscaler, and CrowdStrike and calling it Zero Trust without defining identity architecture, Conditional Access policies, or application access patterns first. Tools without policy design produce expensive, misconfigured infrastructure. Best practice: hire a Zero Trust architect to define the three-pillar policy before issuing any RFPs. Strategy takes 4–8 weeks; tool procurement takes 2 weeks. Do them in that order.

MFA Bypass via Legacy Protocols

MFA deployment on modern authentication does not protect legacy protocol endpoints. If Exchange Online still accepts Basic Auth for an ERP integration, an attacker can authenticate to that ERP connector without triggering MFA - even if the end user has MFA enabled. Every legacy protocol exception is an MFA bypass. Enumerate all exceptions and replace them with OAuth 2.0 or application-specific proxy credentials before MFA enforcement.

IdP Single Point of Failure

Centralizing on Entra ID or Okta creates a single point of authentication failure. When the IdP has an outage (both can still experience outages), all SSO-dependent applications simultaneously become inaccessible. Design break-glass accounts (emergency local administrator accounts) for critical systems before going fully SSO-dependent. Test the break-glass procedure annually.

Over-Permissive Conditional Access

Organizations implementing Conditional Access for the first time set policies in "Report Only" mode to avoid user impact, then never enforce them. Report-only mode produces metrics, not security. Set a deadline: 30 days in report-only, then enforce. Expect some users to be blocked initially due to unmanaged personal devices or missing MFA registration. This is expected friction - work through it systematically, not by disabling the policy.

Implementation Best Practices

Sequence the rollout in three stages: lock down phishing-resistant MFA and break-glass accounts before anything else, enforce Conditional Access and ZTNA one application segment at a time, then sustain it with quarterly access certifications and monthly reviews of trusted locations and IPs.

Identity Foundation

• Enable phishing-resistant MFA (FIDO2/Passkeys) for all administrators before anything else
• Audit all service accounts; rotate passwords and restrict permissions
• Enable Entra ID Identity Protection for risk-based Conditional Access
• Set up break-glass emergency accounts before enforcing MFA organization-wide

Zero Trust Rollout

• Start with Conditional Access in Report Only for 30 days, then enforce
• Enroll all corporate devices in Intune before requiring device compliance
• Replace VPN for one application segment at a time with ZTNA
• Use an IAM specialist for Entra ID architecture - misconfiguration is the leading failure mode

Ongoing Operations

• Run quarterly access certification campaigns (IGA)
• Review Conditional Access named locations and trusted IPs monthly
• Verify break-glass account access works during planned maintenance windows
• Subscribe to Microsoft Entra security advisories - policy changes happen frequently

For Zero Trust cost modeling, see cost benchmarks. For ZTNA, FIDO2, SIEM, and XDR terminology, see the glossary. To compare security implementation partners, see the security and identity modernization companies guide.

Cost Benchmarks

Editorial scoping ranges for security modernization, set against published breach-cost data.

Zero Trust Maturity Model

Zero Trust is built by removing implicit trust from your network in stages. Many organizations are still at the "Traditional" stage.

1. Traditional (The Moat) — VPNs, Firewalls, Passwords. Once inside, you have full access.

2. Advanced (Identity Aware) — MFA everywhere. Cloud Identity (Entra ID). Some segmentation.

3. Optimal (Zero Trust) — Continuous verification. Device health checks. Least privilege access.

Legacy Auth Cliff: Already Reached

Microsoft already disabled Basic Auth for POP3, IMAP and the other Exchange Online protocols in 2022–2023. SMTP AUTH Basic Auth is disabled by default for existing tenants at the end of December 2026, and a final removal date is due in the second half of 2027.

Old ERP Systems — Will Break

Scan-to-Email Printers — Will Break

PowerShell Scripts (Basic Auth) — Will Break

Modern Apps (OAuth 2.0) — Safe

Modern Security Architecture Patterns

1. Identity Provider (IdP) as Control Plane

Entra ID / Okta. Centralizes all authentication.

Pros: SSO for everything, one place to kill access.

Cons: Single point of failure (if IdP goes down, nobody works).

2. Zero Trust Network Access (ZTNA)

Zscaler / Prisma Access. Replaces VPNs.

Pros: Users never touch the network, only specific apps.

Cons: Complex to configure policies for legacy apps.

3. Passwordless Authentication

Windows Hello / FIDO2 Keys / Passkeys.

Pros: Eliminates credential theft (phishing resistant).

Cons: Hardware costs (YubiKeys), user behavior change.

Security & Identity Modernization Services & Vendor Guide

Compare 10 security partners, see IAM market share, and explore Zero Trust implementation services.

View Services Guide →