{
  "id": 3027388,
  "title": "The Perimeter Moved to the Laptop: From Network, to Identity, to the Developer Endpoint",
  "url": "https://urgent.news/2026/08/24/the-perimeter-moved-to-the-laptop-from-network-to-identity-to-the",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-24T13:29:06.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/gitguardian/the-perimeter-moved-to-the-laptop-from-network-to-identity-to-the-developer-endpoint-3bob"
  },
  "original_language": "en",
  "account": "The perimeter of cybersecurity has shifted multiple times over the past three decades. Initially, it was the network, then it became the identity, and now it resides on the developer's laptop. This evolution is driven by the decentralization of workloads, the rise of cloud services, and the use of artificial intelligence in development.\n\nIn the first era, the network served as the perimeter. Firewalls, VPNs, and network segmentation separated internal resources from external threats. However, with the advent of cloud computing, Software-as-a-Service (SaaS) applications, and remote work, the concept of a fixed network edge dissolved, leading to deperimeterization.\n\nThe second era saw identity as the new perimeter. Companies adopted single sign-on (SSO), multi-factor authentication (MFA), and conditional access to manage user access. This shift provided a more granular control plane, but it also left a gap. Identity providers could detect unusual login attempts, but they couldn't inventory the valid credentials already stored on devices.\n\nThe third and current era places the developer's laptop at the center of the perimeter. Developer laptops often harbor a treasure trove of valid credentials, including cloud access keys, API tokens, SSH keys, package-registry tokens, and secrets cached by AI coding agents. These credentials, once valid and authorized, can be used by attackers to gain unauthorized access to cloud accounts, source control, package registries, and SaaS tools.\n\nThe proliferation of credentials on developer laptops is a result of modern development practices that prioritize speed. Developers often authenticate quickly to multiple services, leaving behind tokens in configuration files, caches, and shell history. AI tooling further exacerbates the issue by caching tokens, rewriting configurations, and dropping secrets into temporary files.\n\nThe lack of dedicated coverage for this credential plane on the developer endpoint leaves it as the new edge of the perimeter, yet often the most vulnerable. The attack surface is broad, with no single layer responsible for inventorying or securing these credentials. The attack path is relatively straightforward, starting with the infiltration of a poisoned dependency or compromised extension, followed by the scanning of common credential locations. Once stolen, these credentials can provide attackers with access to valuable resources across the organization.",
  "summary": "👉 TL;DR: The perimeter has moved before. It went from the network to identity, the shift everyone summarized as \"identity is the new perimeter.\" It is moving again, onto the device. Open a developer's laptop, and you will find a stash of working credentials: cloud access keys, API tokens, SSH keys, package-registry tokens, and the secrets AI coding agents cache as they run. Network controls…",
  "key_points": [
    "Perimeter shifted from network to identity to developer laptop",
    "Decentralization, cloud services, AI accelerate change",
    "Developer laptops harbor valid credentials vulnerable to attack"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}