<p>Sidecars co-locate with the workloads they serve and as a result, a vulnerability in one compromises the other.
In the ambient mesh model, even if an application is compromised, the ztunnels and waypoint proxies can still enforce strict security policy on the compromised application’s traffic.
Furthermore, given that Envoy is a mature battle-tested piece of software used by the world&rsquo;s largest network operators, it is likely less vulnerable than the applications it runs alongside.</p><p>While the