We are doing this at $work, everyone says "zero trust" but means something different, high level goals set but hard to translate those to implementation. Someo

We are doing this at $work, everyone says "zero trust" but means something different, high level goals set but hard to translate those to implementation. Someone argued with me that trusting a byod mobile phone for a 2fa app that phones home with checkmarks is zero trust because of the check alone, never mind a user's crappy android that isn't corporate managed/monitored is being used for both first and second factor auth. The fact that they do a lot of auth all over the place yet all that depends on the security of a random user's random personal phone being trusted does not prevent it from being called "the zero-trust way".