Assume Breach.

Assume Breach is a security operating philosophy popularized by Microsoft in the mid-2010s and now the default posture of mature programs and zero-trust architectures. Rather than treating prevention as the primary defense and detection as a backstop, an assume-breach program designs the environment as if the adversary has already gained a foothold and asks how detection, containment, recovery, and limiting blast-radius will hold up. Concretely this drives: network microsegmentation so lateral movement is constrained, identity-centric architecture (every request authenticated and authorized), endpoint detection and response everywhere, centralized logging with retention long enough for true-detection of slow campaigns, regular red-team and purple-team exercises against the live environment (not just labs), automated containment playbooks (isolate host, rotate keys, kill session), and recovery rehearsals (immutable backups, alternative paths to keep the business running). The 2020 SolarWinds/SUNBURST campaign (tracked as UNC2452) is the canonical argument for the posture: a trojanised software update gave the actor months of undetected access inside prevention-hardened networks, and the organisations that fared best were those already watching for anomalous identity and lateral-movement behaviour rather than trusting the perimeter. Mandiant's long-running M-Trends reports track global median dwell time — the interval between intrusion and detection — falling from over 400 days a decade ago to roughly 10 in recent years; assume-breach controls (EDR telemetry, behavioural detection, tight segmentation) are the main reason that number keeps dropping.

Assume Breach is a foundational principle of NIST SP 800-207 Zero Trust Architecture, the U.S. DoD Zero Trust Strategy, the U.K. NCSC Cyber Assessment Framework, and most modern security programs.

flowchart LR
  A[Assume adversary<br/>is already inside] --> B[Microsegment network<br/>limit lateral movement]
  A --> C[Authenticate + authorize<br/>every request]
  A --> D[EDR + centralized logging<br/>everywhere]
  D --> E[Detect anomalous<br/>identity / movement]
  E --> F[Automated containment<br/>isolate, rotate keys, kill session]
  F --> G[Recover from<br/>immutable backups]
  G --> H[Purple-team the live env<br/>feed lessons back]
  H --> A