DoD IL5 authorization raises the bar for mission-scale exposure management

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Armis's blog post: Its cyber exposure management platform has reached DoD IL5 authorization, extending continuous asset intelligence and compliance support into sensitive federal environments.

Why it matters: For IAM and security teams, the key issue is that federal exposure management now depends on continuous visibility, risk prioritization and trust boundaries that extend beyond traditional scan-based tooling.

Context

Federal security programmes are struggling with a visibility problem, not just a tooling problem. Hybrid environments now span IT, OT, IoT and cloud, while mission systems often include unmanaged devices and specialised assets that standard scan-based approaches do not fully capture.

In that context, IL5 authorisation matters because it signals that exposure management is being evaluated for higher-assurance federal use, where continuous monitoring, identity-aware control and operational context have to line up. The problem space is broader than infrastructure alone and touches the same governance gap seen in visibility gaps and unmanaged credentials.

Key questions

Q: Why do mixed IT, OT, and IoT environments make logging governance harder?

A: They produce different formats, transport methods, and event semantics, so one parser or one retention design rarely fits all. That creates silent coverage gaps when new devices appear or vendors change schemas. Governance has to cover the entire collection pipeline, not just the storage layer.

Q: Why do hybrid federal environments create blind spots for traditional security tooling?

A: Because legacy tooling assumes assets are stable, reachable and easy to enumerate, while federal estates often include OT, IoT and mission-specific devices that break those assumptions. When visibility lags behind reality, defenders miss exposures, delay response and lose confidence in the control picture.

Q: What do security teams get wrong about continuous controls monitoring?

A: They often treat it as a compliance report instead of a live verification mechanism. Continuous controls monitoring should prove that MFA, EDR, encryption, and similar safeguards are working against current asset state, not merely documented in policy.

Q: What frameworks matter most when exposure management intersects with federal mission assurance?

A: NIST CSF, NIST SP 800-53 and Zero Trust Architecture are the most relevant starting points because they connect visibility, access control and ongoing monitoring. Teams should use them to align asset governance, control effectiveness and operational resilience around live environment state.

Technical breakdown

Why scan-based exposure management breaks in hybrid federal environments

Legacy scan-based tools assume assets are discoverable on a schedule, have stable network reachability and can be assessed as isolated endpoints. That breaks down when environments include OT, IoT, IoMT, disconnected mission systems and transient cloud assets. Exposure management in that setting has to maintain continuous asset intelligence, correlate operational context and prioritise remediation by mission impact rather than by raw vulnerability count. Without that shift, defenders see inventories that are too late, too shallow or too disconnected from real risk.

Practical implication: Treat asset discovery and prioritisation as a continuous control, not a periodic assessment exercise.

How continuous monitoring changes DoD control posture

Continuous monitoring and risk scoring move the control point from quarterly review to ongoing decision support. Instead of asking whether a system passed a scan, the programme asks whether exposure changed, which assets became visible, which configurations drifted and what operational impact follows. That is closer to Zero Trust Architecture than to legacy perimeter monitoring because trust is continuously re-evaluated against current state. For federal missions, this is especially important where device identity, configuration and connectivity can change faster than governance workflows.

Practical implication: Use continuous monitoring to drive remediation priorities from live exposure state, not annual compliance artefacts.

Why unmanaged and mission-specific devices create governance blind spots

Unmanaged devices and mission-specific technologies sit outside the tidy assumptions of standard asset and identity programmes. They may not support agents, may not be easily patched on conventional schedules and may exist for operational reasons that make them hard to standardise. That creates governance blind spots across both cybersecurity and identity control boundaries, because you cannot protect what you cannot reliably inventory or classify. Exposure management therefore has to bridge discovery, context and policy enforcement across heterogeneous estates.

Practical implication: Build control coverage for unmanaged and mission-specific assets into the same governance model as managed endpoints.

Threat narrative

Attacker objective: The attacker aims to exploit blind spots in hybrid environments so sensitive federal systems remain exposed long enough to support persistence, access and disruption.

1. Entry occurs through the complexity of hybrid federal environments where unmanaged devices, OT and IoT expand the attack surface beyond what traditional tooling can fully observe.
2. Escalation follows when visibility gaps prevent defenders from distinguishing high-risk exposure from routine noise, slowing remediation and allowing adversaries to retain operational access.
3. Impact emerges as delayed detection and fragmented response reduce mission continuity, weaken compliance assurance and leave critical systems exposed longer than intended.

Breaches seen in the wild

• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

IL5 authorisation is a governance signal, not just a procurement milestone. Federal buyers are not only asking whether a platform can be deployed in a sensitive enclave. They are asking whether it can support the operating model required for continuous exposure management across mixed estates. That shifts the discussion from point-in-time compliance to evidence of ongoing control over visibility, prioritisation and response. Practitioners should read IL5 as a test of whether their control architecture can survive mission complexity.

Visibility gaps and unmanaged credentials remain the core exposure problem in federal hybrid estates. The article’s emphasis on continuous asset intelligence matters because the hardest risk is often not a new vulnerability but a system or credential the programme cannot consistently see. That intersection with identity is real: if a platform cannot reliably inventory assets and related access paths, it cannot support meaningful governance of service accounts, device trust or mission-bound access decisions. Teams should treat discoverability as a security control, not an inventory by-product.

Mission-speed defence requires control feedback loops that are faster than traditional compliance cycles. The post describes a world where risk scoring, monitoring and response must operate continuously because adversary pressure and environmental change do not wait for assessment windows. That is the direction federal programmes are moving in: from static attestation toward operational assurance. Practitioners should align governance, response and exception handling to live exposure state rather than to periodic review dates.

The federal exposure-management category is converging with identity-aware security operations. Once a platform claims to operate across IT, OT, IoT, IoMT and cloud, it is really competing on whether it can connect asset context with access context at runtime. That is where authorisation models become relevant, because the practical question is no longer simply what exists but what should be allowed to act on it. The programme implication is clear: exposure management and authorisation governance are becoming adjacent controls, not separate silos.

Zero Trust only works when asset state and trust state stay aligned. The article’s ZTA reference is important because zero trust fails operationally when asset classification, visibility and monitoring lag behind actual environment change. In federal settings, that gap can become the difference between a controlled risk and a mission outage. Teams should align continuous monitoring with trust decisions so policy reflects current state, not stale assumptions.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Mission-speed exposure governance is replacing periodic asset review as the practical baseline for federal programmes. When environments span IT, OT, IoT and cloud, the real question is whether trust decisions can keep pace with changing asset state rather than whether a quarterly control once passed.

The strongest federal programmes will increasingly fuse discovery, authorisation and response into a single operating model. That convergence matters because unmanaged devices and mission-specific systems do not wait for normal lifecycle workflows, so governance has to reflect the pace of operations, not the pace of audits.

The visibility problem now functions as a policy problem. If an organisation cannot see an asset or the access path attached to it, then it cannot credibly claim control over risk, and that is where continuous monitoring becomes a governance requirement rather than a technical enhancement.

For practitioners

• Map mission assets to continuous visibility requirements Define which IT, OT, IoT and IoMT assets must remain discoverable in near real time, then assign owners for classification, monitoring and exception handling. See the NHI Lifecycle Management Guide.
• Tie risk scoring to mission impact Prioritise remediation based on operational consequence, not just vulnerability severity, so defenders fix the exposures most likely to affect mission continuity.
• Align authorisation decisions with live asset context Use current device, workload and network context when deciding what may connect, communicate or execute, especially where mission-specific systems cannot be managed like standard endpoints. See the Authorisation Models Guide.
• Replace periodic scans with continuous control checks Move from scheduled assessments to ongoing validation of discovery, configuration drift and exposure change so new risk is surfaced as soon as it appears.
• Create an unmanaged device governance path Document how mission-specific or hard-to-agent assets are inventoried, reviewed and accepted into the control model without relying on the same tooling used for managed endpoints.

Key takeaways

• The article frames DoD IL5 authorisation as a response to a hybrid-environment visibility problem, not just a certification event.
• Its core operational message is that continuous asset intelligence and risk prioritisation matter more than traditional scan-based control in mission settings.
• The governing control question is whether security teams can maintain live awareness of assets, access paths and operational impact across IT, OT, IoT and cloud.

Related NHI Mgmt Group resources: Ultimate Guide to NHIs: Key Challenges and Risks · NHI Lifecycle Management Guide · Authorisation Models Guide

Key terms

• Continuous Cyber Threat Exposure Management: Continuous cyber threat exposure management is a programme for discovering, validating, analysing, and remediating security exposure on an ongoing basis. It focuses on what is actually exploitable, not just what is theoretically vulnerable. The value comes from combining exposure data, control testing, threat intelligence, and business context into one prioritised workflow.
• Continuous Monitoring: Continuous Monitoring is the ongoing evaluation of access, activity, and control state rather than a periodic snapshot. In practice, it helps teams spot privilege drift, conflicting transactions, and configuration changes before they become audit findings or operational losses.
• Mission-Specific Asset: A mission-specific asset is a system, device or technology deployed for an operational purpose that does not fit standard endpoint assumptions. These assets can be difficult to agent, patch or inventory, which makes them a persistent governance challenge for visibility, classification and control coverage.
• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management for practitioners building resilient identity controls. It helps security teams connect identity governance to the broader operational risks that hybrid environments expose.