That's one of the ways I like to think about it. When you have zero trust, you can comfortably expose any app to the internet. If you can't comfortably expose

That's one of the ways I like to think about it. When you have zero trust, you can comfortably expose any app to the internet. If you can't comfortably expose your app to the internet, you probably don't have zero trust. The problem is, "exposed to the internet" is pretty much how most things are today, in a world where everything is trying to be "smart." There is a pathway to most assets and resources and that's what causes breaches. So all services and resources should be assumed as "exposed" until proven otherwise, therefore all infrastructure (and development) should apply zero trust principles.