Disciplines · 03 · Edge
The old perimeter was a wall around a flat network with a gate in it. The modernized perimeter isn't a wall at all — it's identity, device, and context, evaluated on every request, in front of every app. Most of the work we do at the edge is helping clients stop trying to rebuild the wall in the cloud.
The modernized perimeter has three surfaces where work actually happens. Separating them helps us talk about edge without defaulting to a product list — and helps you see which one your current architecture is underinvesting in.
How your people reach the apps they need — internal line-of-business software, SaaS, published workloads. Global Secure Access and Application Proxy replace VPN and exposed ports with identity-aware access that follows the user, not the network. If VPN is still your remote access strategy, this is the surface with the most room to move.
How the public reaches whatever you've published — web workloads, APIs, custom applications. Front Door, Web Application Firewall, and DDoS sit at this edge. The goal isn't to publish more; it's to publish deliberately, with the right rules in front, and to retire the accidental exposure that creeps in through NAT rules nobody remembers writing.
The engine that actually decides whether any given request goes through — Conditional Access, device compliance, session controls. It reads from every signal the other two surfaces produce and applies the org's intent. Done well, it's the brain. Done poorly, it gets written like an ACL and throws away most of its value.
The products matter less than the shape. The shape is many gates, one policy engine, no flat inside. Every modernization we do starts by drawing that shape and comparing it to what's actually deployed.
The first pattern is castle-and-moat in the cloud. The org moves workloads to Azure and immediately stands up a firewall appliance, builds NAT rules to publish apps, and keeps VPN as the remote access story. The architecture works in the narrow sense — traffic flows — but none of what makes the cloud worth moving to is on. Identity isn't the perimeter. Policy is static. The inside is still flat. Whole categories of modernization stay locked behind a mental model that belongs to a different decade.
The second pattern is Conditional Access as ACL. A policy engine built to evaluate identity, device posture, risk, session context, and location — written as if it were "allow 10.0.0.0/24, deny everyone else." Every signal the engine could be using is ignored. The policy does less than a firewall did, not more.
Underneath both: it's easier to work the way you already work. The cloud showed up and didn't force a new mental model — it just quietly offered one. Nobody defaults to castle-and-moat because it's the best answer; they default to it because nothing in the path actively replaced the old thinking. Unlocking that is most of the work.
Left: the shape most organizations still carry into the cloud. A wall, a gate, a flat inside, a VPN tunnel that drills straight through. Right: the shape of a modernized perimeter. No outer wall. One policy engine. A gate in front of every app that reads identity, device, and context on every request.
The first story is what edge modernization feels like when it lands with a client. The second is how we know the shift in thinking is the real unlock — because it happens the same way with experienced consultants as it does with IT leaders seeing the model for the first time.
The client ran dozens of custom applications published from on-prem and cloud IIS servers. The path in was the familiar one: VPN for staff, firewall NAT for public users. The quiet problem was what VPN implies — an encrypted tunnel the firewall can't inspect, dropped into a flat internal network, with whatever access the user's account happens to carry. One infected laptop is one ground zero. We replaced the whole pattern with Azure Front Door on the public side and Application Proxy and Global Secure Access on the staff side, MFA on everything, no open ports on the edge firewall. Every app got its own gate. Nobody missed the VPN client.
The clearest lightbulb moment on this model didn't come from a client; it came from a fellow consultant working through Enterprise Applications in Global Secure Access for the first time. The instant he saw what an identity-aware, agentless publish-and-gate looked like — next to what VPN-plus-NAT had always looked like — the shift was visible. If a seasoned architect takes a minute to feel the difference, the IT director and the CFO deserve the same runway. We build that moment deliberately into every edge engagement. The architecture doesn't stick without it.
Most edge engagements move in two stages — options on paper, then a pilot that proves the shape. The goal isn't a box we leave behind; it's a team that can run the model, with us supporting from the back.
"If your cloud architecture looks like your datacenter architecture, you didn't migrate. You relocated. The work at the edge is unlocking the mental model that makes the difference visible — because the products don't do that on their own." The stance on the modernized perimeter
Connected to
Conditional Access is the edge's policy engine. It lives here first.
The edge is the front door of the landing zone — the two are designed together.
Modernizing the perimeter is a security move. Exposure work lives on both pages.
Device compliance is the signal the policy engine reads on every request.
Book a call
If the edge architecture in front of your apps was designed for a building you don't work in anymore, the first conversation is the same one: what does a modernized perimeter look like for your business — and what's the smallest pilot that proves the shape.
Or reach us directly: info@fouronesixit.ca · (647) 371-0400