Beyond the perimeter: The network as the security fabric for the AI era

Enterprises have historically built separate network and security architectures, but this separation is becoming increasingly difficult to maintain as frontier AI models mature and security architectures shift from perimeter-based defenses to identity- and context-aware enforcement.

Frontier AI does not change existing cybersecurity fundamentals; it narrows the time available to apply them. As attacks move from human speed to machine speed, enterprises need security controls that can detect, respond, and enforce at the same speed. The network is uniquely positioned to become that enforcement and containment fabric.

The AI era requires enterprises to treat the network as an active security control, not simply as infrastructure to be protected. By integrating identity, telemetry, segmentation, and automated enforcement, the network can reduce exposure, contain compromise, and accelerate recovery at machine speed.

A brief look at how security has evolved

Traditional firewalls established an enterprise perimeter, while demilitarized zones created controlled, externally facing segments that restricted access to internal resources. Network access control lists added another enforcement layer by limiting communication to or from IP addresses associated with unauthorized users and devices.

As threats evolved, enterprises needed controls more granular than zones and IP addresses. Architectures such as Cisco ACI and TrustSec enabled application traffic to be permitted or denied according to identity and context, rather than relying only on addressing or device type.

Next-generation firewalls extended this identity- and context-aware model to perimeter enforcement by distinguishing among applications, users, devices, content, and threats.

The migration of workloads, applications, and data to cloud environments expanded the security boundary beyond enterprise-controlled infrastructure and required controls designed for cloud configuration, workloads, applications, and access.

Software-defined WAN then helped establish the Secure Access Service Edge model, combining SD-WAN connectivity with Security Service Edge capabilities such as secure web gateways, cloud access security brokers, firewall as a service, and zero-trust network access.

The frontier AI era

Frontier models have crossed an important cybersecurity threshold: AI-based models can increasingly discover vulnerabilities, develop exploits, orchestrate attack chains, and operate with levels of autonomy that compress attack cycles from days or hours to machine speed.

Enterprises must therefore now design security architectures on the assumption that compromise will occur.

This change demands a security strategy that reduces exposure before an attack, contains damage during a breach, accelerates response, and restores operations quickly.

The key pillars of this security approach are:

• Attack surface management: Reducing exploitable opportunities and weaknesses.
• Blast radius reduction: Reducing the scope of damage when a breach occurs.
• AI-enhanced security operations: Accelerating detection and response so defenders can keep pace with machine-speed attacks.
• Enhanced resilience and recovery: Restoring critical services rapidly and reducing the overall impact on the enterprise.

Supporting measures will include stronger patch management, segmentation as a core cyber-resilience capability, and virtual shielding. Together, these controls minimize the attack surface and reduce the blast radius where vulnerabilities cannot be remediated immediately.

Identity governance must extend beyond human users to include non-human identities associated with agentic AI, automated systems, and the internet of things. Unlike traditional users, who typically interact with applications and systems one action at a time, AI agents can operate continuously, interact directly with APIs, and other agents, and execute actions at machine speed.

Zero trust is evolving from an access architecture into a continuous operating model in which every request to a protected resource is explicitly authenticated and authorized, regardless of whether it originates inside or outside the enterprise environment.

In a zero-trust environment, identity determines which resources a user, device, workload, or agent may access. The network then becomes a critical control point for limiting how far that authorized access can extend across the enterprise.

The network as the enforcement fabric

Enterprises should prioritize their most critical business services, automate security operations, and strengthen network resilience so that prevention, containment, response, and recovery function as one operating model. Within that model, the secure network must provide five core capabilities:

• Visibility: Provides visibility into traffic between users, devices, workloads, applications, APIs, agents, and data.
• Enforcement: Convert identity, posture, application, and threat intelligence into access decisions.
• Segmentation: Prevent a compromised identity, workload, or AI agent from becoming an enterprise-wide compromise.
• Telemetry: Use network behavior as a detection signal for increasingly rapid and autonomous attacks.
• Containment: Isolate workloads, revoke communication paths, and constrain east-west movement at machine speed.

In the frontier AI era, preventing every breach is no longer a realistic strategy. The objective is to make compromise difficult, lateral movement constrained, detection immediate, and recovery rapid. Achieving that objective requires identity, endpoint, cloud, and application security to operate as an integrated system, with the network providing the visibility, segmentation, and enforcement fabric that connects them.

The network is no longer simply infrastructure to be secured. It is becoming part of the security architecture itself.

Hear from the experts

How can enterprises turn the network into an active layer of security in the AI era? Watch this webinar to hear experts from NTT DATA, Cisco, and IDC discuss how organizations can evolve their network architectures to improve visibility, contain threats, and strengthen resilience.