Within a ZTA, should there be some level of packet capture at pre-defined ingress/egress points? With all the technology and effort in the World, stopping a committed attacker is still an awesome task. My thinking is that if an organisation did suffer an intrusion, even in their ZTA, combining the monitoring data from each tech stack and then constructing a replay event in a designated safe harbour environment would allow ongoing key customisation of defensive policies.