A logistics officer at a forward operating location opens a maintenance report. It came from a credentialed contractor, over an approved channel, to an authenticated user on a compliant device. Every Zero Trust control did exactly what it was designed to do.
The report was still the attack.
That is the gap in the DoD's Zero Trust journey. The architecture did not fail. It was never asked the right question about the file itself.
Zero Trust is built to answer one question with rigor: should this entity be allowed to retrieve this resource?
Phishing-resistant MFA, device compliance checks, microsegmentation and least-privilege policies all serve that question, and they serve it well.
But there is a second question that sits right beside it: is the content of this resource safe to open?
Access controls were never designed to answer it. Treating the first answer as if it settles the second is a category error, and it is the one adversaries count on.
Think of it as the envelope and the payload. Today's Data pillar implementations govern the envelope: classification, labeling, rights management, who can touch what. Very little asks whether what is inside is safe. A file can carry the right markings, travel the right path, reach the right person, and still deliver malicious code the moment it is opened.
U.S. government advisories have repeatedly documented nation-state actors using weaponized files to gain initial access. In one joint advisory, the FBI, CISA, U.S. Cyber Command's Cyber National Mission Force and the U.K.'s National Cyber Security Centre described Iranian actors sending ZIP files that held an Excel file with a malicious macro or a PDF that dropped malware onto the victim's network. Some adversaries go after identity directly. Many do not need to. They get inside a trusted file-exchange relationship and let that trust carry their payload the rest of the way.
That relationship might be a second-tier supplier delivering engineering drawings to a program office. It might be a coalition partner whose network was compromised upstream. It might be an insider account that was quietly taken over months ago. In each case, the sender checks out. The file does not.
The harder Zero Trust makes it to forge an identity, the more valuable a legitimate one becomes. Strong access controls do not remove the incentive to weaponize content; they concentrate it on the channels the mission already trusts most.
Files are the medium of operations: ISR products, operational orders, maintenance data, test reports, software deliverables, logistics plans. Commanders make decisions on them. Warfighters act on them. Program offices field capability through them.
That is why a weaponized file works so well. It arrives the same way the mission's own information does, and someone opens it for the same reason: they need it to do their job.
The cost of a missed file-borne threat in this environment is not measured in help-desk tickets. It is measured in compromised planning cycles, eroded trust with coalition partners, delayed fielding and adversary access to networks that underpin operations. When the threat model is a determined nation-state, the mission standard has to be higher than "probably safe."
Closing the gap does not mean abandoning "never trust, always verify." It means applying that principle one layer deeper, to the content itself.
Detection-based tools try to answer the content question by recognizing what is bad. That approach has a ceiling: a threat has to be recognized before it can be stopped, so novel or custom payloads can reach users first. Adversaries targeting DoD networks build custom payloads specifically to stay outside signature libraries and sandbox heuristics.
A mission-grade answer flips the question. Instead of asking is this file malicious?, it asks what should a legitimate file of this type contain?
It then rebuilds each supported file to that standard, keeping the content the mission needs and removing active and non-conforming content according to policy. Nothing has to be recognized as a threat to be removed. That is the approach Glasswall's Zero Trust Content Disarm and Reconstruction (CDR) takes, and it gives defenders something detection cannot: a consistent, deterministic outcome, whether or not the exploit has been seen before.
It also complements the access-focused work already underway. Data labeling and rights management govern who can use the information. Content verification makes sure the file is safe to open. A complete Data pillar needs both.
The Department is working toward Target Level Zero Trust by the end of FY 2027. Read the Data pillar of the Capability Execution Roadmap and you will find labeling, tagging, rights management, data loss prevention, monitoring and access control. You will not find an activity that asks whether a file is safe to open. Closing that gap comes down to a few decisions that CIOs, ISSMs and program managers can make today:
Zero Trust has already changed how the DoD thinks about identity, devices and networks. The next step is extending that same discipline to the information the mission runs on. The adversary does not need to beat your identity provider. The goal is to get a malicious file opened on a network that matters.
Verifying who sent a file is half the job. Verifying what is inside it finishes it.
Talk to an expert for a deeper look at the Data pillar gap and how to close it, and read the full Glasswall whitepaper, Eliminating the DoD Zero Trust File Blind Spot.
Kelly Davis, our Senior Solutions Architect, brings deep expertise in DevOps, IT architecture, and Zero Trust security. Previously he was a Lead IT Specialist at the Command Control and Communication Tactical Directorate Communications Networks Division in the DoD, delivering secure, scalable solutions in high-stakes environments. At Glasswall, he applies this experience to drive innovation and resilience in our cybersecurity solutions.
A tailored walkthrough of how Glasswall rebuilds files to a known-good state, removes hidden threats, and provides the intelligence you need to understand file risk.
What's in the demo
“
Beazley's security is paramount, and this integration has significantly reinforced our cybersecurity framework.
