The study explores the risks and tradeoffs when adapting enterprise-IT security and zero trust principles to weapon systems.
October 27, 2025—The Department of Defense (DoD) is mandated to begin adopting zero-trust (ZT) cybersecurity practices for its weapon systems and operational technology.
The ZT approach, which authenticates every interaction in a network, applies most directly to enterprise information technology (EIT) and does not easily translate to weapon systems and defense critical infrastructure.
A recent study by the Software Engineering Institute (SEI) analyzes the applicability of nine security and ZT principles to weapon systems and the resulting security risks and tradeoffs.
In a ZT architecture, every user, application, system, and device is untrusted by default, and every request to access computing resources must be authenticated.
A ZT approach authenticates every interaction in a network.
Author summary: SEI study on zero-trust principles.