A server can be hardened. An identity can have MFA. An API can be protected. A cloud workload can pass its security checks. Look at each component individually and everything may appear reasonably secure.
The problem is that attackers rarely look at systems individually.
They look at how one system trusts another.
That is why the argument in Every Trust Relationship Is an Attack Path is worth paying attention to. A trust relationship may be necessary for the business to work, but every connection between identities, applications, platforms and vendors also creates a possible route through the environment.
Think about how attacks actually progress. A compromised user account may provide access to an administrative workstation. That workstation may have a trusted session to a management server. The management server may hold an automation credential. That credential may have access to critical workloads.
Individually, none of those systems has to be catastrophically insecure. The risk appears when the relationships connect.
This is why security teams can miss important exposure when they assess assets one at a time. Vulnerability scans tell us what is weak. Identity reviews tell us who has access. Architecture diagrams show how systems connect. But attackers combine all three.
The same problem is becoming more important with cloud services, APIs, SaaS integrations and AI agents. Modern environments contain machine identities, tokens, service accounts and automated trust relationships that may never involve a human login. Each new integration makes the environment more useful, but it can also extend the path an attacker might follow.
The answer is not to eliminate trust. Modern systems cannot operate without it.
The better approach is to understand where trust exists, how far it extends and what an attacker could reach if one side of that relationship were compromised.
Security architecture therefore needs to look beyond individual controls.
A system may be secure on its own.
The more important question is: what does it trust, and what trusts it?