From my understanding, it's slightly different. There can still be an inside and outside, but the inside doesn't get special privileges just because they are i

From my understanding, it's slightly different. There can still be an inside and outside, but the inside doesn't get special privileges just because they are inside. So it's not like each employee connects directly to the public internet and all emails, files, attachments, wikis are all exposed to the public internet and exchanged over the public internet between employees. It's likely all these are still internal to the corporate network and not accessible from the public internet. But if you are inside the network, you don't default to having access to it all either, there is an additional access control in place no matter if it is inside or not. Now depending how confident you are on your access control layer, I have seen some companies literally expose things to the public internet and allow employees to access it without a VPN from any computer or mobile phone connected to the public internet from anywhere. I guess you can consider that on the extreme end of zero trust. But also the question here is does CloudFlare not consider inside camera feeds (which if employees go back to office could let you look at their screens) data that should itself be secured behind their zero trust access controls?