castle-and-moat
expressionsecurity
The perimeter security model: strong walls at the edge, broad trust for anyone already inside.
It matched the world where everything lived in one building behind one firewall. Cloud, SaaS, and remote work dissolved the moat - the resources left the castle - which is the whole argument for zero trust's per-request verification.
Castle and moat describes perimeter security: a hard boundary with controlled crossings, and an interior where traffic is trusted because it got past the wall. It was the dominant model for decades and it was reasonable while the assumptions held, which were that valuable things were inside, users were inside, and the boundary was crossable only in known places.
Every one of those assumptions failed. Applications moved to providers outside the wall, users worked from anywhere, mobile devices left and returned carrying whatever they picked up, and partner integrations opened crossings nobody drew on the diagram. A perimeter around an empty castle protects nothing.
The failure mode when it collapses is that the interior was never designed to resist anything, so a single compromised endpoint has flat access to everything. That is the observation that produced zero trust, and the honest reading is not that perimeters were wrong but that they became insufficient: a boundary is still worth having, and it can no longer be the only place a decision is made. The replacement is authorization per request rather than trust by location.
Also known as: perimeter security model