Zero trust: never trust the network

The perimeter model says inside the network is trusted. It fails because getting inside is cheap — one phished credential or one compromised container — and on a flat network the attacker then moves laterally, accepted everywhere because of where the packets came from.

Zero trust changes the unit of decision: authenticate and authorise every request on user identity and device posture. The source address becomes context, never permission. That is P56's authorization thinking applied at the network layer.

This module builds the decision function, then steps back to the migration question: what do you change first in a real network?