For three decades, enterprise security has been chasing the user. First we built walls around them with VDI and published desktops. Then we followed them into the cloud with ZTNA. Now, with Citrix SPA and Chrome Enterprise, security lives where it always should have — inside the session, invisible to the user and inescapable to the threat. This is the story of how we stopped building moats and started building trust.