Most zero-trust conversations start with people: single sign-on, MFA, device posture, and conditional access for engineers and employees. That work matters. It is also only half the traffic in a modern estate.

The other half never touches a browser. A checkout service calls an inventory service. A reporting job reads from a database in another cloud. An inference endpoint receives requests from an application running somewhere else entirely. Those service-to-service calls are usually trusted because of where they come from — a VPC, a subnet, a VPN tunnel, a private range that was considered safe when it was drawn.

That assumption is the problem zero trust was meant to remove. If network location is the credential, then anything that reaches that network segment inherits the trust, including a compromised workload, a misconfigured job, and a test service that was never meant to run in production.

1.…