Zero trust at year two: What nobody planned for