Where security architecture stands, and why most organisations run several at once
In plain words: Security has grown up in stages, from a locked front door to guards who check everyone everywhere, and most places still use a mix of old and new. Architecture and strategy, explained simply
In short
- Security architecture has gone through seven stages: ad hoc, perimeter, defence in depth, zero trust, security mesh, adaptive and AI-native. Each stage fixed the weakness of the one before.
- No stage ever switched the one before it off. Every estate I know is a mix, with older patterns still protecting parts of it.
- The useful question is not "which stage are we?" but "which stage does each part of the estate need to be at, and what is between here and there?"
The picture
The Ascent of Security Architecture on the home page tells the story in seven steps. It borrows the "march of progress" picture on purpose: each step is a new way of living with threats, and each arrives sooner than the one before.
- Ad hoc. Security is whatever was bought last, and each machine looks after itself.
- Perimeter. A wall around a trusted inside. Phishing and remote workers walked straight past the gate.
- Defence in depth. More walls, plus logs gathered in one place. Every layer became its own tool with its own console.
- Zero trust. Identity, not location, decides access, request by request. The decisions are scattered across many separate engines.
- Security mesh. Many tools, one fabric: shared identity, analytics and policy, enforced next to every asset.
- Adaptive. The architecture senses risk and acts on it continuously, driven by exposure management and analytics.
- AI-native. AI agents on both sides, defending and attacking at machine speed.
Why the mix matters
Each stage solved a real problem and created the next one. That is why none of them disappears. The mainframe that was never moved still sits behind a perimeter. The data centre still has layers of controls. The newest cloud platform may already be close to zero trust. All three belong to one organisation, run by one security team, and all three are reasonable.
That makes "what stage are we at?" the wrong question. It invites a single score, a single roadmap and a single vendor pitch. The better question is which stage each part of the estate needs. A payments platform and an internal wiki do not need the same one.
What changed
The pressure now is not a new kind of wall. It is volume and speed. There are too many signals for people to weigh by hand, risk changes by the minute, and AI lets attackers and defenders move faster than a person can follow. That is why the late stages talk about loops rather than layers: measure, decide, act, and measure again.
Where most organisations are
My own view: the common mix is three or four stages at once. A perimeter that is mostly retired but not quite. Layers of controls that still do most of the work. Zero trust done well for workforce access and not yet for workloads. A first piece of mesh or exposure management where one team found it paid off. I have not measured this across the industry, so read it as a practitioner's observation, not a survey result.
What to do on Monday
- List the main parts of your estate and name, honestly, which stage each one runs on today.
- For each, decide the stage it needs, based on what it holds and who can reach it, not on what is fashionable.
- Pick the one gap where the step up buys the most risk reduction, and make that the next piece of work.
- Check that your tools can share identity, signals and policy. That is what the later stages depend on.
Sources
- The Ascent of Security Architecture, on the lgkm.org home page, an independent synthesis for architecture discussion. Years are approximate.
- NIST, SP 800-207: Zero Trust Architecture (2020).
- Gartner's cybersecurity mesh architecture, proposed in 2021, as the Ascent describes it.
Personal work and my own view, not my employer's. Sources are public.