The Battle Within: The Perimeter Is No Longer the Problem
When I was a kid, I loved watching Ultraman. As a child of the 1980s, it was one of those shows that captured my attention week after week. What always fascinated me was that the monsters rarely attacked the city from the outside. Instead, they would suddenly appear within the city itself.
At the time, I never gave it much thought. It was simply part of the storyline. However, years later, in the field of cybersecurity, that concept has taken on a very different meaning. Ultimately, that is exactly how many of today’s cyber threats operate.
The Shift in the Threat Landscape
For many years, cybersecurity strategies were built around a straightforward premise: keep attackers out. Organizations invested heavily in perimeter defenses such as firewalls, intrusion prevention systems, and email filtering technologies, all designed to stop threats before they could enter the network. For a time, that approach was effective. However, the modern threat landscape has evolved significantly.
Today, attackers often do not need to break through a hardened perimeter. In many cases, they are already inside the environment before anyone realizes it. This can occur through compromised user credentials, trusted third-party applications, or integrations that were implemented without a full understanding of their security implications. Increasingly, it is also happening through technologies that organizations have willingly adopted to improve productivity and efficiency.
The reality is that the perimeter has not disappeared, but it has become far less relevant as a primary line of defense. Much like the threats depicted in Ultraman, each new challenge presents a different set of behaviors and capabilities. Today’s cyber threats operate in much the same way, constantly evolving and adapting to the defenses organizations put in place.
When Innovation Outpaces Defense
Organizations across industries are rapidly adopting artificial intelligence tools to enhance productivity. These tools are being used to summarize documents, generate code, analyze data, and automate workflows. The benefits are undeniable, and the intent behind adoption is positive. However, the associated risks are often less visible.
Artificial intelligence capabilities are now embedded within many of the platforms employees use every day, including email systems, collaboration tools, browsers, and other SaaS applications. In many cases, employees are connecting these tools to internal documents, customer information, and proprietary data without fully understanding how that data is being processed, stored, or shared.
For example, an employee may use an AI assistant to summarize a client contract or analyze financial data. In doing so, sensitive information may be transmitted to a third-party model, stored for processing, or even retained for future training depending on the platform’s configuration. Without clear governance, organizations may have little to no visibility into these interactions. This is not the result of malicious behavior. Rather, it is a natural consequence of innovation moving faster than governance, and organizations may not recognize the risk until after it has already occurred.
The challenge is that these technologies introduce new pathways for data exposure, and unfortunately, traditional security controls were not designed to monitor or manage these effectively. As a result, organizations may unknowingly expand their attack surface while attempting to improve efficiency.
The Enemy Is Already Inside the City
There is a common perception that cyberattacks are loud, disruptive events that begin with an obvious breach. In reality, many modern attacks are far more subtle and far more strategic. From my experience, they often begin with legitimate access.
An attacker may gain entry through valid credentials obtained via phishing or credential reuse. A seemingly harmless application may be granted access through an OAuth connection. A trusted user may unknowingly introduce risk through everyday actions. Once inside, the attacker does not need to force their way through defenses. Instead, they move laterally within the environment, blending in with normal activity and avoiding detection.
Consider a scenario where an attacker gains access to a single user account within a cloud environment. From that point, they may access shared files, review internal communications, and identify additional targets. They may escalate privileges, create persistence mechanisms, or exfiltrate data slowly over time to avoid triggering alerts.
This type of activity does not resemble the traditional image of a cyberattack. There are no alarms or immediate disruptions. Instead, it is a gradual compromise that unfolds within the trusted boundaries of the organization.
In Ultraman, there was always a moment when his color timer began to blink, signaling that time was running out. In cybersecurity, organizations have a similar clock; they just don’t always recognize when it starts. The longer a threat operates undetected within the environment, the more difficult it becomes to contain.
Defending the City Isn’t Getting Easier
From a business perspective, the challenge is not a lack of investment in security. Many organizations have deployed multiple tools and technologies designed to protect their environment. The difficulty lies in managing and making sense of those investments.
Security teams frequently face an overwhelming volume of alerts generated by systems that do not communicate effectively with one another. Visibility into SaaS environments and cloud-based applications is often limited, particularly when shadow IT or unauthorized integrations are present.
At the same time, there is a shortage of skilled personnel available to investigate and respond to potential threats. This creates a situation where alerts may go unreviewed or unresolved, increasing the risk of undetected compromise.
Adding to this complexity is the growing pressure of compliance requirements. Organizations must navigate frameworks, audits, and regulatory expectations, all while attempting to maintain operational efficiency. In many cases, compliance efforts focus on documentation and control validation rather than real-time risk reduction. The result is an environment where organizations have data, tools, and alerts, but lack the clarity and coordination needed to act effectively.
Fighting Yesterday’s Battles
In many cases, organizations continue to approach security in a reactive manner. When an issue is identified, it is addressed, and attention shifts to the next priority. While this approach is understandable, it is not sufficient in today’s environment. Addressing individual issues without understanding the broader context can lead to a cycle of recurring problems. One vulnerability is remediated, only for another to emerge. One attack vector is blocked, while others remain unaddressed.
This reactive model focuses on symptoms rather than root causes. Without a shift in approach, organizations can find themselves facing the same types of threats repeatedly, just in slightly different forms. It is similar to responding to each incident as an isolated event rather than recognizing patterns and systemic weaknesses.
Over time, this approach can create a false sense of security, as organizations believe they are making progress while underlying risks continue to grow. In a landscape where threats can originate from within, organizations must move beyond isolated fixes and adopt a more comprehensive, continuous approach to managing risk.
Building a Stronger Defense System
Protecting modern environments requires a shift in both mindset and strategy. The foundation of this approach is visibility. Organizations must have a clear understanding of their assets, data, and connections across the environment. This includes not only on-premises systems, but also cloud platforms, SaaS applications, and third-party integrations. Without this visibility, it is impossible to identify existing exposures or assess potential risk accurately.
Equally important is alignment. Security cannot operate in isolation from the business. Leadership must be engaged in defining risk tolerance, prioritizing initiatives, and ensuring that security efforts support broader organizational objectives. This alignment helps ensure that resources are allocated effectively and that security decisions are made in the context of business impact.
From there, organizations must adopt a continuous approach to risk management. Threats evolve daily, and security practices must evolve alongside them. This includes ongoing evaluation of the attack surface, continuous monitoring of user and system activity, and the ability to detect anomalies that may indicate compromise.
Finally, organizations must be prepared to act. In Ultraman, the hero may have been the most visible line of defense, but he was never operating alone. The Science Patrol worked behind the scenes, identifying threats and coordinating responses. Cybersecurity requires that same level of coordination, where technology, processes, and skilled teams operate together rather than in isolation.
Identifying a threat is only the first step. The ability to contain and mitigate that threat quickly is what ultimately determines the impact on the business. This requires not only technology, but also clearly defined processes and responsibilities.
Protecting the City Means Protecting the Business
One of the most significant changes in recent years is the recognition that cybersecurity is not solely an IT concern. It is a business issue that affects every aspect of an organization. The consequences of a security incident extend far beyond technical systems. They can disrupt operations, result in financial loss, damage reputation, and erode customer trust. In regulated industries, they can also lead to legal and compliance-related consequences.
As a result, security must be integrated into the broader business strategy. It should be considered in decision-making processes, investment planning, and risk management discussions. Organizations that take this approach are better equipped to navigate the complexities of the modern threat landscape and to respond effectively when incidents occur.
For organizations operating in regulated industries such as healthcare, education, and government, these risks extend beyond operational impact. They directly affect compliance with frameworks such as HIPAA, FERPA, and other regulatory standards, where data exposure can result in both financial penalties and loss of trust.
Questions Every Organization Should Be Asking
In an environment where threats are increasingly embedded within everyday operations, organizations should begin by asking a few critical questions:
- Where is artificial intelligence currently embedded within our tools and platforms?
- What types of data are being shared with these systems?
- Do we have visibility into how these tools are being used across the organization?
Beyond AI, organizations should also consider:
- Do we understand where our identities are exposed and how they are being protected?
- Do we have a comprehensive view of our attack surface?
- If a security event were to occur, how quickly would we detect it?
These questions serve as a starting point for building a more resilient and informed security posture.
A Lesson from the City
Reflecting on those early episodes of Ultraman, the storyline now feels less like fiction and more like a lesson. The threats did not always come from outside the city walls. They often emerged from within, catching everyone off guard. Today, organizations face a similar reality. The challenge is no longer limited to keeping attackers out. It is understanding what may already exist within the environment and building a strategy that accounts for it.
Cybersecurity is no longer a negotiable component of business operations. It is a foundational element of resilience, trust, and long-term success. And in a world where threats can appear without warning from within, awareness, preparation, and continuous vigilance are more critical than ever. Because in today’s environment, the threat isn’t always trying to get in. Sometimes, it’s already there.
Keith Johnson
Keith Johnson is executive vice president at Obviam.