Most traditional network security strategies rely on a premise that aged out around the same time as dial-up internet: if someone is physically inside your building—or connected to your VPN—they belong there. It is the digital equivalent of trusting anyone who walks past reception simply because they happen to be holding a coffee cup and wearing a lanyard.
In IT, we call this the "castle-and-moat" security model. Once you cross the moat, you have free rein over the kingdom. You can wander into accounting, browse HR files, and borrow the company secrets for the weekend.

