Secure a hybrid network by dropping the idea that being inside it earns trust. NIST SP 800-207 says no implicit trust should be given to assets or accounts because of physical or network location. Verify each request to each resource, segment the network, and keep an inventory of what is where.
Why do hybrid networks break the old model?
The old model drew a perimeter: trusted inside, untrusted outside. Hybrid environments have no single inside. Staff connect from home, workloads run in more than one cloud, and a data center link joins it all. NIST's zero trust architecture document says this shift responds to remote users, bring-your-own devices and cloud assets outside an enterprise-owned network boundary, and that network location is no longer the prime component of a resource's security posture.
What does zero trust ask you to do?
It moves protection to the resource. The NIST document focuses on assets, services, workflows and accounts, not network segments. It describes authentication and authorization of both subject and device as discrete functions performed before a session to an enterprise resource is established.
In plain terms, a connection from the corporate VPN is not enough on its own. The system asks who is calling, from what device, and whether that identity may reach this one resource.
Where do attackers actually get in?
CISA's ransomware guidance lists internet-facing vulnerabilities and misconfigurations such as exposed RDP, compromised credentials, phishing, precursor malware and third party providers as common entry points. Each of these is easier in a hybrid network because there are more edges. CISA's recommended architecture response is zero trust, least privilege and network segmentation.
Constructed example: a company has an office network, two cloud accounts and a vendor with a support tunnel. A vendor laptop is compromised. With a flat network the attacker reaches file servers and a database host. With segmentation and per resource authorization, the tunnel reaches one ticketing system and nothing else.
What should be segmented?
Segment by what a failure would cost, not by where hardware sits.
- Management interfaces (hypervisors, cloud consoles, switches) in their own restricted zone.
- Production data stores apart from office workstations.
- Third party access on a separate path with a short life.
- Development and test apart from production, in every location.
How to check or apply this
- Build one inventory covering office, data center and every cloud account. You cannot protect what is missing from the list.
- Mark every internet-facing service. Close what is not needed and patch the rest quickly, starting with known exploited vulnerabilities.
- Require multifactor authentication on every remote and administrative path. CISA recommends phishing-resistant MFA.
- Replace broad network rules with rules per application: this identity may reach this service.
- Cut third party access to named systems, with an expiry.
- Centralize logs from every location in one place, and baseline normal traffic so odd traffic shows.
- Test restore from offline backups, in each environment.
How does Safeguard relate to this?
Safeguard works at the software layer. It discovers assets and scans dependencies and code so you know what runs in each environment and what is vulnerable. It does not provide network security products, so segmentation and traffic controls stay with your network team.
Quick check
Does a VPN make a hybrid network zero trust?
No. A VPN extends network location. Zero trust, per NIST SP 800-207, grants no implicit trust based on location and verifies each session to each resource.
What is the first step?
A complete inventory of assets and accounts across all locations, since every other control depends on knowing what exists.
Sources
Last reviewed: 18 October 2026.
