Key Takeaways
- Zero trust network security assumes that network location or previous authentication needs to prove its trustworthiness.
- Segmentation is only as good as the traffic evidence behind it, and protecting mission data means watching where that data goes.
- Deep Session Inspection and retrospective analysis give investigators more to work with than connection logs do.
- Zero Trust network security is best measured by what happens when trust is abused.
- Fidelis Network gives defense SOCs a way to detect suspicious communications and attacker behavior even when access looks authorized.
The Department of Defense can verify every login, enforce strict access policy, and segment its networks, and still have no good answer to a simple question:
What happens when an adversary starts operating through an account or connection the system already trusts?
A September 2026 U.S. Government Accountability Office (GAO) report[1] found that 6 of the 18 major DoD IT business programs it reviewed had not developed plans to implement Zero Trust architecture by the 2027 deadline.
Much of that work falls under the following categories:
- Policy deployment
- Stronger authentication
- Tighter access rules
- Finer segmentation
However, these controls decide who gets in and which paths are open in the network. They say nothing about whether the policies match how the network actually behaves, or what a trusted identity does after the door opens.
A serious zero trust approach to network security has to answer three things.
- Do the policies hold up against real traffic?
- Is legitimate access being misused?
- Can suspicious behavior be investigated without disrupting critical operations?
All three are network questions, and the network is where Fidelis Network® earns an evaluation. It is built to examine activities even after access has been granted, which is the stage most Zero Trust programs do not cover.
- Enterprise-wide visibility
- Transactional monitoring
- Zero Trust in Action
What Zero Trust Network Security Means for the Department of Defense
Zero trust network security drops the assumption that network location or a previous authentication is trustworthy. Access is granted according to:
- Identity
- Device posture
- Policy
- Resource sensitivity
It is calibrated again when the conditions change.
Of the pillars in the DoD’s Zero Trust model, Network & Environment and Visibility & Analytics deserve the closest attention from network security leaders. Together they describe a requirement that goes beyond permission checks.
Defenders need to see communications inside their environments, and they need enough evidence to recognize when behavior shifts. This is because the zero trust network security model is a decision framework, but a decision is only as reliable as the information behind it.
Fidelis Network supplies the missing information through:
- Continuous traffic inspection
- Threat detection
- Investigation capabilities
This helps security teams identify when apparently trusted activity deserves a closer look or a change in enforcement.
How Does Fidelis Network Help with Zero Trust Network Security?
Segmentation Starts with Knowing What Actually Communicates
Implementing Zero Trust usually begins with a mapping problem. Before you can restrict communication between any two systems, you need to know the relationship between them. The systems that depend on each other should continue to communicate, but the ones that are not related their connection should not exist.
In a large defense environment, those dependencies run across:
- Administrative systems
- Operational infrastructure
- Mission-support applications
- Remote installations
- Approved hybrid environments
Segment too tightly and you break a service someone depends on. Segment too loosely and you leave adversaries room to move after a compromise. Most teams discover that the manually maintained inventory they planned around does not reflect what is really on the wire.
The DoD Network & Environment pillar treats data flow mapping as a foundational capability, and Fidelis Network addresses it through:
Rather than relying on inventories someone has to keep current by hand, it uses observed communications to identify assets, understand their relationships, and reveal the network paths between them.
An architect can use that to ask practical questions:
- Which systems regularly talk to a given mission-support application?
- Is a management server reaching resources outside its expected operational area?
- Which unmanaged or legacy assets are showing up in traffic?
- Does the traffic between two segments reflect a real operational dependency?
Consider a maintenance application that needs periodic contact with a system in another network zone. If the connection is blocked without understanding the dependency, the operations will get interrupted. And if it is left open permanently, it is a standing risk that nobody reviews.
In such cases, observed traffic evidence enables the architect to separate an expected dependency from a connection that needs scrutiny, which means segmentation decisions rest on measured behavior instead of assumptions about how the environment works.
Segmentation Does Not Stop an Attacker Who is Already Inside
Micro-segmentation helps by limiting unnecessary communication between systems. But assuming segmentation will stop malicious activity is a mistake. Unfortunately, Zero Trust programs drift into it when enforcement becomes the main measure of progress.
For instance, when an attacker who has compromised a trusted account spends most of the time moving between systems inside the policy-permitted zone, that movement may never produce a new perimeter event. In such cases if the security team is watching the boundaries will never be aware of the most consequential phase of the attack.
This is the gap Fidelis Network® Deep Session Inspection addresses, and it is where reliance on flow records or perimeter alerts falls short.
| Flow Data | Deep Session Inspection (DSI) |
|---|---|
Flow data can establish:
| DSI reassembles:
|
Fidelis Network combines deep session inspection with behavioral analytics and threat intelligence to flag suspicious activity across monitored traffic. The platform supports boundary-focused monitoring, and internal sensors are designed to analyze east-west traffic.
For a defense SOC, the objective is to catch movement before the attacker reaches additional high-value resources, and in such cases, internal visibility is what makes that objective achievable.
Inspecting Encrypted Traffic Without Assuming Everything Can Be Decrypted
Encryption is essential to protecting military and defense communications, and security teams still have to investigate those communications. The practical question is how much can be learned without requiring access to every encrypted payload.
Fidelis Network handles this with two complementary methods.
- The first is session metadata analysis. DSI examines available TLS and network metadata to identify suspicious patterns without decrypting the underlying content.
- The second is deeper content inspection where it is authorized. Fidelis supports decrypted traffic inspection through appropriate deployment integrations and policies, including supported proxy-based inspection workflows.
Support for both is important in DoD environments, where encryption requirements, security boundaries, and mission sensitivity can restrict where decryption is permitted at all.
Fidelis can examine encrypted traffic without treating all of it as readable content. In practice, that lets architects choose inspection methods to fit the technical and security constraints of each part of the network, instead of forcing one approach across all of them.
Mission Data Needs Protection After Access is Granted
Zero Trust is fundamentally not about controlling who enters the network, but protecting resources and information. For defense organizations, the exposure covers:
- Operational information
- Sensitive communications
- Personnel records
- Technical documents
- Other mission-related data
Not every exposure involves a sophisticated intrusion. In 2023, reports[2] revealed that more than 117,000 emails intended for the U.S. military’s .mil addresses had been mistakenly directed to Mali’s .ml domain, including messages that potentially contained sensitive information.
Nobody had to defeat an authentication control for that to happen. Users were authenticated, the network access was approved, and the data still left. That is the case for content-aware controls in the network layer.
Fidelis Network DLP inspects supported communications and applies policy-based data protection rules. It can analyze reconstructed session content where that content is available, including supported email, web, and network inspection workflows. Depending on the sensor and enforcement configuration, it can alert on suspicious activity and take supported preventive actions.
Investigating Suspicious Activity with Network Evidence
Detecting an unexpected connection is the easy part. Working out what it means is slower.
Say an internal sensor flags suspicious communication between an administrative workstation and a mission-support server. The analyst has to decide among three possibilities:
- An approved administrative task
- A compromised account using legitimate tools
- One piece of a wider intrusion
Each calls for a different response, and an alert alone does not separate them.
Fidelis Network’s forensic capabilities are aimed at exactly that distinction.
- DSI reconstructs observed sessions and decodes supported protocols, so investigators can examine historical metadata, relevant communication artifacts, transferred files where inspection permits, and the security detections associated with the activity.
- Retrospective threat hunting adds another dimension, letting analysts revisit stored network evidence when new threat intelligence or indicators arrive. A connection that looked routine last month may look very different against today’s indicators.
- Fidelis provides MITRE ATT&CK-aligned investigation context, helping analysts relate observed behavior to known adversary techniques.
For organizations using Fidelis Elevate® XDR, network findings can be connected with available endpoint and deception evidence for a broader investigation.
What this gives a DoD security team is the ability to establish the likely scope of a compromise before making decisions that could affect mission operations.
Responding Without Disrupting the Mission
Incident response in a defense setting involves a hard tradeoff. If you fail to contain a genuine intrusion, the attacker can reach more systems. If you act too aggressively on an uncertain alert, you can take down an essential application or operational dependency. A security tool generating an alert does not make either outcome acceptable.
Fidelis Network supports that decision through threat detection, investigation context, configurable security rules, and integration with response technologies. It supports preventive actions through applicable network, email, and web enforcement configurations, and it can share findings with other tools to coordinate response.
The deployment details matter here. Passive sensors observe mirrored traffic and avoid introducing an inline inspection point, but passive visibility alone does not guarantee that a malicious connection can be stopped before it completes. Where prevention is required, defense architects need to validate the supported enforcement path and how it interacts with existing network controls.
For instance, take a suspicious connection originating from a management server. Disconnecting an entire network segment in response is rarely the right first move. The SOC may first need to:
- Identify the server’s operational dependencies
- Confirm the threat
- Determine whether a narrower action can contain it
Fidelis gives investigators the network evidence needed to make that call, which makes response decisions more informed and better matched to operational risk.
- Block attacks before damage occurs
- Prevent lateral movement inside your network
- Reduce false positives & alert fatigue
Zero Trust Has to Work After Access Is Granted
The DoD’s Zero Trust ambitions cannot be met by treating authentication as the final security decision, or by assuming segmentation will expose every malicious action. The complex interconnections in defense networks make it impossible, and the cost of both undetected compromise and unnecessary disruption is too high.
A mature architecture needs evidence of what users, devices, applications, and systems do after they are permitted to communicate. Fidelis Network® provides that evidence through:
- Deep Session Inspection
- Cyber terrain mapping
- Behavioral detection
- Network forensics
- Data loss prevention
Defense security teams can examine communications, identify suspicious activity, investigate potential compromise, and protect information moving across their networks with Fidelis.
For defense leaders assessing Zero Trust maturity, one test is worth running. If an attacker used legitimately authorized access, could your current architecture detect it and explain what happened?
If the answer is uncertain, Fidelis Network is worth evaluating as the network detection and investigation layer that closes that gap.
Citations:
