Not gonna lie - "Raw Sewage network" is pretty spot on. A huge part of zero trust principles is that all networks are untrustworthy, raw sewage networks.

So the types of attacks that this protects against are all the 0day CVEs that are AV:N/PR:N. (attack vector=network, privileges required=none). That's the sort of thing like log4shell and the like. The only devices that could leverage those types of attacks would be trusted and authorized identities. That's probably a small number of machines, making the attack that much harder.

Also DoS attacks are a lot harder because the "server" (whatever accepts connections) is generally dark to the network and only available over the overlay network. Being on the same subnet (or you know, the whole internet) doesn't help if you're not authorized to access the service in the first place.

Where it's really cool is that you don't need to worry about cloud ACLs. Pick your laptop from one raw sewage network to another and it doesn't matter. You don't need to whitelist a new IP in the ACL. That's really convenient for today's road warriors. Similarly, you don't need to whitelist the whole enterprise's exit IP to the cloud.

So that sort of thing. Hopefully that answers your question enough but if not lemme know

there are few things that improve your defense posture:

- DDOS attacks can only attack the fabric and not the business logic service. Fabric nodes can be easily moved around or added to change attack surface.

- you can have multiple services hidden and you don't have to worry about protecting them individually

- service nodes themselves can be moved around or added for redundancy without having to stand up additional protection middleware