Security is not a feature that gets added late. It is a set of assumptions about who is already inside, made early and written down.

Assume the network is hostile and the caller is unproven.

Zero trust is not a product you buy. NIST wrote the architecture down in SP 800-207: no implicit trust from location, authorisation evaluated per request, and the blast radius of a compromised credential bounded by design rather than by hope. NIST SP 800-207

Depth is what buys you time, and time is the whole game.

Every breach in the record below had a window between first access and discovery. Layers do not prevent compromise; they make it slow and loud enough that a human notices while it still matters. defence in depth

An unpatched known vulnerability is a decision, not an accident.

Equifax is in the record below for exactly this. The patch existed. The scanner missed one host. Calling that bad luck is how it happens again; calling it an unowned inventory is how it stops.