How does our approach to security change if we assume they are already on the network?