Not gonna lie - "Raw Sewage network" is pretty spot on. A huge part of zero trust principles is that all networks are untrustworthy, raw sewage networks. So th

Not gonna lie - "Raw Sewage network" is pretty spot on. A huge part of zero trust principles is that all networks are untrustworthy, raw sewage networks. So the types of attacks that this protects against are all the 0day CVEs that are AV:N/PR:N. (attack vector=network, privileges required=none). That's the sort of thing like log4shell and the like. The only devices that could leverage those types of attacks would be trusted and authorized identities. That's probably a small number of machines, making the attack that much harder. Also DoS attacks are a lot harder because the "server" (whatever accepts connections) is generally dark to the network and only available over the overlay network. Being on the same subnet (or you know, the whole internet) doesn't help if you're not authorized to access the service in the first place. Where it's really cool is that you don't need to worry about cloud ACLs. Pick your laptop from one raw sewage network to another and it doesn't matter. You don't need to whitelist a new IP in the ACL. That's really convenient for today's road warriors. Similarly, you don't need to whitelist the whole enterprise's exit IP to the cloud. So that sort of thing. Hopefully that answers your question enough but if not lemme know