I've said it before, but Zero Trust is such a misnomer. It implies less trust in firewalls, VPNs, and other network controls, but much more trust in the ability of end-user devices to securely store and use private keys. Also, the server side has has to trust all incoming connections from the Internet enough to verify the certificates, and run a complicated TLS implementation, which can be a huge attack surface. We're sticking with WireGuard for all our internal users.

AI slop, and marketing slop at that.

Intune and basic CA policies ensure unexportable MDM certificates in the TPM are used for all authentication events. This is like day 1 Entra ID / Intune stuff. Not sure why you'd need an external vendor for any of this (especially a vendor more expensive than the above).