The network firewall the enterprise has been running for twenty years has been quietly developing a second life, the life the Zero Trust pitch has been promising to replace, the life the modern network the cloud architect has been building has been quietly relying on. The honest framing matters here, because the network firewall the security team has been treating as the legacy box the security team will eventually retire sits as the network firewall the cloud migration has been quietly making more important, not less.
What follows runs as the working version of the field guide. The shorter version is what the security team and the network team actually have time to read.
What the firewall still does
Three things, in roughly that order of how much each one matters. The first runs as the east west segmentation, where the segmentation the firewall provides between the segments of the data center, the segmentation the cloud has been replacing for the application traffic, the segmentation the on prem workload still needs, the segmentation the firewall has been the only thing providing. The second runs as the egress control, where the control the firewall still applies, the control the cloud has been partial about, the control the firewall provides for the data exfiltration, the command and control callback, the control the firewall gives the security team the cloud has been slowly eroding. The third runs as the compliance artefact, where the artefact the firewall has been producing for the audit, the artefact the auditor has been accepting, the artefact the compliance team has been using to demonstrate the network control, the artefact the firewall has been quietly underwriting for twenty years.
What the cloud changed
Three things, in roughly that order of how much each one matters. The first runs as the perimeter dissolved, where the perimeter the firewall was protecting, the perimeter the cloud has been dissolving as the workload moved to the cloud, the perimeter the cloud native security control has been replacing for the cloud workload, the perimeter the firewall cannot protect because the workload does not sit behind the firewall. The second runs as the identity became the new perimeter, where the perimeter the identity provides, the MFA, the conditional access, the device posture, the perimeter the Zero Trust pitch has been promising, the perimeter the firewall cannot provide. The third runs as the east west became the new battleground, where the battleground the cloud workload has been producing, the battleground the API call, the container to container connection, the battleground the firewall cannot see because the traffic does not leave the host.
How to land the second life
Three moves if you are the network team that wants the firewall the enterprise has been paying for to deliver the second life the cloud migration requires. Keep the perimeter for the on prem, where the on prem the enterprise has been keeping for the legacy system, the on prem the firewall still protects, the on prem the firewall should keep protecting until the on prem workload migrates to the cloud. Add the cloud native firewall, where the firewall the cloud platform provides (the AWS Network Firewall, the Azure Firewall, the GCP Firewall), the firewall that protects the cloud workload, the firewall the cloud architect should configure from day one of the cloud migration. Add the identity control, where the control the identity provider provides, the MFA, the conditional access, the device posture, the control the security team should be layering on top of the firewall the security team has been keeping, the control the firewall cannot provide. The network team that keeps the on prem, adds the cloud native, layers the identity serves as the network team that has landed the second life of the firewall.
The bottom line
Network firewall in 2026 sits as the legacy box the security team has been quietly extending. The east west segmentation, the egress control, the compliance artefact, those three are what it still does. The perimeter dissolved, the identity became the perimeter, the east west became the battleground, those three are what the cloud changed. The on prem, the cloud native, the identity control, those three are the moves. The network team that does the three lands the second life. The team that retires the firewall without the replacement does not.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
