The trust gap between people and services
Human users are typically subject to real scrutiny: strong authentication, monitored sessions, access reviews. The services those humans built often talk to each other with far less — a shared network location treated as sufficient proof of legitimacy, or a static credential embedded in configuration and rarely rotated. An attacker who reaches one internal service can often move to the next simply because nothing was checking.
Closing this gap means giving every service its own verifiable identity — through a mechanism like mutual TLS, where each side of a connection presents and checks a certificate — rather than relying on network placement as an implicit credential.
Why this matters more as systems get more automated
As more of a system's internal traffic comes from automated processes and agents rather than humans acting directly, the volume of service-to-service calls grows relative to human-initiated ones — and so does the consequence of leaving that traffic weakly authorized. A single compromised internal service with unchecked trust from its neighbors can reach far more, far faster, than a compromised human account typically could.