Like all cultural changes, a zero-trust culture starts with a conversation around where the security risks lie and how security needs to adapt to changing applications and infrastructure landscape.