There is a particular kind of conversation that happens when a small business gets breached. Somebody asks where the firewall was. And the honest answer, increasingly, is that there wasn't one, because there was nothing left for it to sit in front of. The business runs on a website it doesn't host, email it doesn't run, a payment processor it doesn't operate, and a laptop that connects to all of them from a kitchen table. There is no network edge. There is no inside. The thing everybody spent twenty years learning to defend simply isn't there any more. That is the shape of the problem, and it is why the security industry keeps announcing that the perimeter is dead. But the perimeter is not dead. It moved, it fragmented, and it multiplied. For a business whose most exposed asset is a public website, the new perimeter is small enough to write on a single page — which is precisely what makes it defensible, and precisely why so few businesses have done it. This guide is about drawing that page. Not a zero trust architecture programme. Not a reference model written for an organisation with a security team. An actual inventory of the things that, if someone else controlled them, would end your ability to operate — and what to do about each one. What the ‘perimeter’ used to mean, and what actually changed The traditional model was physical before it was digital. Your computers sat in your building. They talked to each other over cable you owned. Anything from outside had to pass through one controlled point, and you put your defences at that point. Castle and moat, as the metaphor goes, though the more accurate comparison is a factory with one gate and a security desk. It worked because two assumptions held. The first was that everything valuable sat inside a boundary you could draw. The second was that traffic crossing that boundary was rare enough and slow enough to inspect. Both assumptions have now failed, and they failed for ordinary commercial reasons rather than security ones. The three shifts that dissolved the boundary Software moved off your premises....
