The part I agree with most: the fundamentals do not change. Phishing-resistant MFA everywhere, not just the VPN. EDR on everything. Watch east-west traffic and DNS. Assume one set of creds gets popped and make sure it does not open the whole building.
XFEDI
ActivityPubConversation
I would add one. An agent that lands still needs something to run, a driver, an RMM, a LOLBin. Default-deny app control takes those away, and it does not get tired either. Make every step cost more time, tokens and compute.
Try default-deny app control free with https://MagicSword.io: https://magicsword.io
MagicSwordApplication Control for the Tools Attackers Abuse | MagicSwordUse threat research to decide what runs. Start in audit mode with agent-based deployment. Free forever for up to 100 endpoints.