Closing Security Gaps with a Zero Trust Approach: Lessons from 100+ Security Audits