Hackers routinely compromise identity credentials and use them to access systems and move laterally in the network. Therefore, trust cannot be inferred solely from whether a user is inside or outside the corporate network.