In addition to zero trust and privacy by design, the authors discuss strategies for reducing human-related risk when enterprises are no longer confined to physical spaces. They also call into question some cybersecurity myths that can lead to poor decisions and business practices. The authors argue that while cyber threats are continuously changing and emerging and should remain an area of focus, the ever-expanding attack surface is also a challenge. Another concern to consider is improving security skills, so the authors suggest a decision framework that includes vulnerabilities around social and human elements in addition to physical and information systems.