Design security assuming attackers are already inside the network. This forces defenders to compartmentalize access and monitor everywhere, rather than relying on a strong perimeter.