[thewebguyd]

Hence zero-trust, buzzwords aside.

You should absolutely assume breach as part of your company's security policy/trust model.