3 years ago a colleague asked me when $company would be zero-trust-ready & we (the security team) would annoy them about not putting stuff on the internet, even if it has auth.

3 years later all I can say is: lmao