For the U.S. Army, the challenge of Zero Trust is increasingly not how to define the concept, but how to apply it at scale. The service is working to bring roughly 5,000 IT systems onto a shared Enterprise Identity, Credential and Access Management platform, or E-ICAM. Many of those systems were built long before interoperability became a priority.
At the same time, Zero Trust requirements are moving beyond traditional enterprise networks to the tactical edge, operational technology, weapon systems and, increasingly, artificial intelligence agents.
That makes Zero Trust less a destination than a security model that must continually adapt.
“We can’t just buy Zero Trust from a vendor; it isn’t just compliance,” said David Thompson, E-ICAM product lead at Army CPE Command and Control Information Network. He said the Army must keep adjusting as adversaries, policies and technology evolve.
Identity becomes the first line of defense
Identity lies at the heart of the model. Any entity seeking access to a resource must be identified, linked to a credential and authorized. That applies not only to people, but also to devices, applications and other non-human entities.
“Everything that connects to something else to access a resource has to be positively identified, strongly bound to a credential and securely granted access,” Thompson said. “Everything means literally everything, from human users to non-human interfaces and every physical or virtual component in between.”
A key part of that approach is fine-grained, repeated authentication. Users, devices, data and AI agents must be checked regularly to retain access, rather than authenticated only when they first connect.
One platform, thousands of legacy systems
The immediate challenge is the wide variation in the age and technical capabilities of Army systems. Some have been in service for decades and have not kept pace with modernization. Rather than impose a single technical solution on every system, the Army is developing different onboarding pathways and applying the access controls each system can support today.
Thompson compared the task to securing a government building. Security measures might be placed at the gate, the main entrance, the elevator, interior doors or even individual desk drawers. Older buildings, however, may not have all those barriers.
“If the building doesn’t have interior doors or desks, we have to secure what we can today, with the expectation that we’ll support the customer’s future security improvements tomorrow,” he said.
Legacy systems are therefore likely to remain one of the biggest barriers to full Zero Trust implementation. Curtis Dukes, executive vice president and general manager of Security Best Practices at the Center for Internet Security, said some older systems may need substantial upgrades to meet the new requirements.
That flexibility matters as the Army works toward a deadline of the end of 2027 for meeting all Zero Trust target milestones. Thompson called bringing thousands of systems into a Zero Trust posture by then “a huge goal.”
Bringing systems on board by operational domain
One option under consideration is onboarding systems by operational domain instead of handling every system individually. The Army is also developing ways for system owners to take on more of the work themselves.
“We’re trying to pioneer a way to onboard operational domains that may have hundreds or maybe a thousand IT systems within them,” Thompson said. The Army is developing a “do-it-yourself kit” to help system owners make changes without having to work one-on-one with the C2IN team.
For that approach to succeed, system owners need to understand what assets they have and how those systems operate. Army teams have sometimes found that owners themselves lack a complete view of their IT environments.
“It’s not one-size-fits-all; every IT system is unique,” Thompson said. “It’s hard, but not because it’s complicated. It’s because it’s very detail-oriented.”
Securing access is not enough to protect data
Verifying a user’s or device’s identity does not by itself protect the information that user or device can reach. Zero Trust controls must therefore extend to the data, not just access to it.
Mario Puras, senior vice president of Global Solutions Engineering and Architecture at Netskope, said the model must include continuous verification, rapid threat containment and comprehensive data protection.
“The mission fails if user access is secured but the data is compromised,” he said.
Under this approach, access decisions can change in response to identity, device posture, behavior, content and other contextual signals. Policies are applied at the data level, drawing on information about users, devices, network connections and applications.
Those controls become more important as military environments rely on cloud services, APIs, collaboration platforms and encrypted traffic. Attempts to move sensitive information through API calls, cloud uploads or chat messages are examples of activity that Zero Trust systems may need to inspect and control.
AI agents complicate the identity picture
The growing use of AI agents adds another layer to identity management. For Thompson, the underlying rule does not change when the entity seeking access is not human: AI agents also need identities, limited entitlements and least-privilege access.
“It’s not a different paradigm; it’s the same paradigm, but we’ve got to get faster,” he said. Automation, he warned, could accelerate hostile activity from a few attacks per minute to hundreds or even thousands per second.
Dukes also highlighted the risks posed by agents that delegate tasks to other agents. Organizations will need to manage trust across chains of non-human identities and prepare for unauthorized “shadow agents,” as well as agents that behave unexpectedly or are compromised.
Zero Trust moves to the tactical edge
At the tactical level, connectivity is another constraint. Units at brigade level and above can generally expect access to Army cloud resources. Forces below brigade, however, must prepare to operate with denied, degraded, intermittent or limited connectivity.
Those formations need enough local E-ICAM capability to continue their missions while disconnected and update information when connectivity returns.
The same Zero Trust principles are also expected to apply to operational technology, industrial control systems, connected devices and the individual components that make up weapon systems.
Thompson offered the example of a helicopter: identity attributes could determine whether a particular person is authorized to start the aircraft.
“If Dave Thompson is going to jump in a helicopter, does Dave Thompson have the authority to turn it on?” he asked. The answer depends on the individual’s identity, its associated attributes and the actions that identity is permitted to perform.
The Zero Trust challenge has thus moved far beyond logging on to a network. The Army must determine which person, machine, application or AI agent can access each resource, what it may do once it has access, and how permissions should change as technology, missions and threats evolve.
As Thompson put it when discussing operational technology, Zero Trust “isn’t an end state; it’s a continual action.”
