Zero trust security across the attack surface