You're completely missing the point. The internal network I'm describing should be nothing more than server metal and virtual workstations. Your border is minis

You're completely missing the point. The internal network I'm describing should be nothing more than server metal and virtual workstations. Your border is miniscule at that point. You no longer have to fret about network ports in conference rooms. You no longer have to worry about testing your OS and software patches on the 20 iterations of lifecycle replacement hardware that is floating out in your company. You don't even need to invest heavily in workstations, as thin clients will suffice for most situations. Business continuity becomes a piece of cake because you're no longer factoring in the physical workstation beyond ensuring your cold site has a box of laptops in the corner. Your concern about rampant malware won't even matter because the only way people can access the web services is through the VMs. The thin clients and physical workstations won't even be able to access most of those services that are mission critical. In the situation where a company provided physical workstation is necessary, that machine would be just as isolated from the internal network as anyone else. Developers can use one of those, or use VMs that are VLAN'd off. And if your developers are automating their builds and containerizing, then your developers are going through layers of services and automation before their code goes out to production, so even they won't need access to production environments from their relatively insecure dev laptops.