Ask a security team what their endpoint coverage is and you will get a percentage. Ninety-four, ninety-seven, some number in the high nineties.
Ask what the rest is and the room goes quiet, because nobody knows. That is definitionally what the number means.
Coverage that is a list is coverage that is already wrong
An agent protects the machines you enrolled. That is a roster, and a roster is a snapshot of what someone remembered to add.
Outside it: the contractor’s laptop, the personal machine somebody used once because the VPN was down, the build server stood up for a project that ended, the acquired company’s fleet that is still six months from migration. None of these are hypothetical. They are the standing condition of every organization above about fifty people.
And the gap is not random. Unmanaged machines are unmanaged because they escaped a process, which correlates almost perfectly with the machines you would most want to be watching.
The control and the threat share a host
There is a second problem with living on the device, and it is structural rather than administrative.
An agent runs in the same place as the adversary. The access that compromises the host is the access that can disable, starve, or degrade the thing watching the host. Any control that depends on being alive on the machine it is protecting has a dependency on that machine’s integrity, which is the exact property in question.
Bind to the path and there is nothing on the endpoint to switch off, because there is nothing on the endpoint.
Coverage stops being a list
Put the control where the file moves and the roster disappears. Anything that crosses is inspected. Managed or unmanaged, known or forgotten, enrolled or not. The question “which devices are covered” stops having an answer because it stops being the right question.
This is what Zero Trust for Files asks of the deployment: bind to the data path, not the device inventory. Not because agents are bad at what they do, but because what they do is bounded by a list, and the list is always missing the machine you would have wanted on it.