Ensuring seamless access in contested environments with zero trust

Click here to watch the full discussion.

The Army’s push toward a zero-trust architecture is reshaping how it approaches cybersecurity, mission readiness and data management.

Matt McDougall, G-6 senior technical advisor for U.S. Army Western Hemisphere Command, said zero trust architecture is foundational to how the service operates in an increasingly contested environment.

“It’s absolutely fundamental to what we do as we move to a data-centric architecture, supporting how we war fight,” McDougall said. “Senior leaders need to be able to trust the information as gleaned from the data that’s provided.”

Operating in degraded environments, where networks may be disrupted or adversaries are actively targeting systems, is essential for Army IT. McDougall said the Army’s zero trust architecture continues to adapt as technology and the threat landscape evolve.

“We’re always going to continuously evolve and learn and adjust, and implement newer technologies as they come forward and we learn more,” he said.

The Army is applying this principle across its entire enterprise. McDougall said the Army is ensuring its networks remain secure while ensuring service members have access to the data they need at the speed of mission.

“One of the largest hurdles is applying the appropriate security controls without hindering operational tactical organizations and how they conduct warfare,” he said. “It’s definitely a balance that takes many across the operational spectrum, having that shared understanding of the battlefield and risks and also understanding of the technology and how it’s applied to our mission.”

The Army is moving away from a manual compliance model for cybersecurity to one that is continuously monitored. McDougall said security controls are also being baked into systems as the Army deploys them. That approach is helping reduce friction for users while maintaining strong protections.

“Cybersecurity teams are being integrated with the mission owners to ensure there’s a shared understanding of applying security controls so they’re not, they’re doing it like all security controls are applied in a practical manner and tailored for specific operational risks,” McDougall said.

Data management is a central part of the Army’s zero trust strategy. Understanding what data exists, where it resides and how it’s used is critical to applying the right protections.

“We have to map out what and where data is required and provide it within our architectures, so then we can apply the right policies and controls to those specific situations,” McDougall said.

Automation and human oversight

Automation and artificial intelligence are playing an increasing role in strengthening cyber defenses, particularly through continuous monitoring.

“Utilizing AI and machine learning systems can continuously analyze network activity to identify anomalous behavior and also potential risks instantly,” McDougall said. “We’re continuously evaluating on how they can continuously analyze network activity to identify anomalous behavior and also potential risks instantly. Because when you really look at applying zero trust against our environments, it’s not a onetime event. Security controls as part of our zero trust framework are continuously reevaluating users, devices and access to ensure compliance with the policies we’ve set in place.”

That automation is not a replacement for human judgment. Instead, automation helps free up personnel to focus on higher-value tasks.

“You still have to have humans to validate, because humans bring that context of what’s going on,” McDougall said. “Automation allows us to focus on computers to handle some of those mundane tasks, but also frees up our users to focus on what are the key tasks.”

It also enables faster identification of patterns and emerging threats.

“Another thing automation allows us to do is identify patterns a little bit more easily. If we’re set to look for certain anomalous events, but now all of a sudden, if we’re identifying a pattern, AI and different automation tools can identify those patterns. It allows us to focus our efforts on the right area,” McDougall said.

Identity, devices and data trust

Identity management remains a cornerstone of the Army’s zero trust approach. Technologies like multifactor authentication are being deployed broadly, though implementation varies by environment.

“For identity management at the edge, so we still have that surety that that data is secure, and the people that are accessing it have access to those systems. It’s just not a free-for-all at the tactical edge versus up in the cloud, where it’s a little bit easier, you have a lot more resources. The Army is always exploring different technologies to make it interoperable with not only ourselves, but also our mission partners and allies,” McDougall said.

Ultimately, the goal is to ensure that data remains trustworthy and usable, even in disrupted conditions.

“We’re going to face all kinds of denied, degraded events to where we may be cut off, or systems go down, but we still have to trust the data we have. We want to have a clear source of truth to the data we’re using,” McDougall said.

Building resilience with zero trust

Richard Breakiron, senior director for strategic initiatives for the Americas Public Sector at Commvault, said agencies across government are grappling with similar challenges as they adopt zero trust and modernize their environments.

“People look at any type of zero trust architecture or a lot of compliance and they always say, ‘This is a ball and chain.’ I am always the first person to say, ‘No, this is the strategic advantage your company is going to have. You are going to be more resilient, and you are going to be able to withstand catastrophes when you get attacked.’”

Breakiron stressed the importance of preparation and testing, particularly when it comes to recovering from cyber incidents. He also stressed the need for organizations to operate effectively even when systems are degraded.

“When you go into combat, you know you’re going to be working in a degraded environment after the first engagement. In other words, it’s not going to get better as a conflict begins. It is a destructive capability. But sometimes it’s not even just about restoring. It is about, ‘Can you maintain operations in a degraded environment? Can you work when you’re isolated from that big network that you’ve been so dependent on? What happens when GPS is not available because of events of the day?’” he said. “Zero trust architecture is meant to say, ‘This is assuming a difficult environment, and you need to build for that.’”

Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.