The reality of implementing zero trust for defense operational technology

May 14, 2026 - 05:00

The defense industrial base is being told to adopt zero trust security, but the reality of applying that model to operational technology is far more complex than many realize. While zero trust has proven effective in IT environments, military systems like weapons platforms, radar arrays, and battlefield networks were never built with constant authentication and micro-segmentation in mind.

The core problem is that operational technology, or OT, often relies on legacy hardware and proprietary protocols that cannot simply be patched or retrofitted. A tank's fire control system or a ship's propulsion management software may run on decades-old code that does not support modern identity verification. Forcing zero trust onto these systems without careful planning can introduce latency or even cause critical failures.

Experts argue that the defense ecosystem must expand its zero trust approach to cover all systems warfighters depend on, not just office networks. This means developing specialized gateways, air-gapped monitoring, and behavior-based anomaly detection that can work alongside older equipment. It also requires a shift in mindset: instead of assuming every device inside the perimeter is safe, defenders must treat every sensor, actuator, and controller as a potential threat.

The challenge is not just technical but cultural. Procurement cycles are slow, and contractors are hesitant to redesign proven hardware. Yet with adversaries constantly probing for weak points, the military cannot afford to wait. The path forward involves incremental upgrades, rigorous testing, and a willingness to accept that perfect zero trust may never arrive for some systems. For now, the goal is to get closer to that ideal without breaking the tools that keep soldiers alive.