"just" defense in depth? Why not also say, "Our network is so well-architected that no one can sniff our packets, so even if data is not encrypted, that's not a

"just" defense in depth? Why not also say, "Our network is so well-architected that no one can sniff our packets, so even if data is not encrypted, that's not a problem." The answer is that things break, tests can fail to test what you think they are testing, you need these layers because something like this (at least in spirit) will happen at some point.