zero trust and zero day windows - does 'assume breach' actually hold up when the window is hours not

been thinking about this a lot after the ZDI-CAN-25373 disclosure last year. for context, this is the.lnk file zero-day that Microsoft rated low severity and decided didn't meet the bar for patching, meanwhile Trend Micro had already, identified close to a thousand malicious samples in the wild going back years, tied to eleven different state-sponsored groups across North Korea, Iran, Russia, and China. no patch still issued. that gap between 'we know about it' and 'you're protected' is exactly where things get uncomfortable. the framing I keep coming back to is that zero trust doesn't really stop the initial exploit, but, if your least privilege and microsegmentation are actually working, a compromised endpoint shouldn't be able to go anywhere useful. the blast radius question is everything. the problem is that's all theoretical until you test it, and most orgs I've seen haven't validated, whether their policy enforcement actually holds up against lateral movement from an unmanaged or partially managed device. what I'm less sure about is whether policy evaluation is fast enough when the attack window shrinks to hours. there's been a broader push lately toward enforcement over visibility, which makes sense in principle, but enforcement against a novel technique, before your tooling has seen it feels like it relies heavily on behavioral anomaly detection catching something early enough to actually matter. there's also an interesting counter-argument gaining traction around prevention-first endpoint design, the idea being that if you, cut the active code surface dramatically you reduce the compromise vectors before assume breach even becomes relevant. curious whether people are finding that continuous policy evaluation automation is genuinely keeping pace with that, kind of threat tempo, or whether there's still a meaningful lag that APTs can operate inside.