A claim now circulating in regional security commentary runs roughly as follows: the NCSC's Cyber Assessment Framework v4.0 now covers AI risk, no GCC framework does, and that gap matters.

Zero Trust is not failing. It is stalling — and it stalls in a consistent, predictable place.

Defence in depth is the most widely quoted and least rigorously implemented concept in enterprise security.