The dominant model in data security says: find everything first. Scan the estate. Classify what is there. Build the map. Then protect what you found.

It is a reasonable sequence with one flaw. The map is never finished, and everything not yet on it is unprotected by definition.

Discovery is a permanent project

There is always another share. A bucket from a project that ended in 2021. A folder on a laptop. An archive inside an archive inside a backup of a system that was decommissioned but whose storage nobody reclaimed. A departmental tool somebody expensed.

Discovery does not converge, because the estate is not a fixed target. It grows faster on the days you are not looking, and the parts that resist discovery are the parts that were set up outside the process, which is the same population as the parts you would most want mapped.

So the model has a structural gap. Its coverage is bounded by its inventory, its inventory is bounded by discovery, and discovery is never done. You end up with an excellent map of the territory you already controlled.

A boundary does not ask where the file came from

Enforcement at a boundary has none of this. It never needs to know the file exists. It has no opinion about where the file was stored, who owned the share, whether anyone classified it, or whether it was ever seen before.

It sees the file at the only moment that decides anything: when it tries to cross.

A file you never inventoried, from a system you forgot, on a share nobody documented, still arrives at the gate. It is inspected on what it contains, right then. Its history is not an input.

Not knowing about it is not a gap. It is the point.

Blindness as a property

This inverts something people assume. A control that does not know your estate sounds weaker than one that has mapped it. It is the opposite, because a map is a liability that has to be maintained and a boundary is a fact that does not.

Zero Trust for Files asks that the flow be protected without an enumeration of what is at rest. Topology, not discovery. Protect the crossing, and the shadow share you never found is covered by the same act that covers the ones you did.