Why "inside the network" stopped meaning "safe" — and what actually replaced that assumption.
For decades, network security was built like a castle: put strong defenses at the boundary — firewalls, VPN gateways, network segmentation — and treat anything that made it past that boundary as trustworthy. The model worked reasonably well when "the network" had an obvious edge. It fails badly against how breaches actually happen today, because it hands out one thing it can never take back cheaply: broad implicit trust, granted the moment someone crosses a single line. Zero trust exists specifically to close that gap.