Notifications
Clear all
Topic starter
02/08/2026 12:11 pm
TL;DR: The DoD’s Cybersecurity Risk Management Construct shifts security oversight from annual, paperwork-heavy RMF checks toward continuous, evidence-driven validation, according to Horizons.ai. That change makes attacker-path testing and rapid remediation the operational baseline, not a periodic audit exercise.
NHIMG editorial — based on content published by Horizons.ai: How Horizon3.ai is Supporting the DoW Cybersecurity Risk Management Construct (CSRMC)
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities.
Questions worth separating out
Q: What breaks when validation is only performed at fixed intervals?
A: Fixed-interval testing misses the period when a new misconfiguration, exposed credential, or permission change is most exploitable.
Q: Why do standing privileges become more dangerous in fast-changing environments?
A: Standing privileges become more dangerous because the risk attached to an entitlement changes as soon as the environment changes.
Q: How do security teams know whether Teams remediation is working?
A: They should measure dwell time, removal latency, and the percentage of malicious messages removed before any user interaction.
Practitioner guidance
- Implement continuous attack-path validation Run recurring adversary-style tests against internal, external, cloud, and Kubernetes surfaces so teams can see which identity and configuration weaknesses are exploitable now, not last quarter.
- Prioritise exploit-chain remediation Group findings by chained attack paths that connect weak credentials, policy gaps, and over-privileged accounts.
- Verify fixes before closing the loop Re-test after remediation to confirm the specific attack path is gone, especially when access scope, credentials, or network exposure changed.
What's in the full article
Horizons.ai's full blog covers the operational detail this post intentionally leaves for the source:
- How NodeZero is positioned for internal, external, cloud, and Kubernetes validation in production-safe environments
- The Find, Fix, Verify workflow and how the vendor describes prioritisation and re-testing
- Federal ecosystem references, including the frameworks and programmes the article claims alignment with
- Integration touchpoints with ServiceNow, Jira, and SIEM workflows for continuous risk management
👉 Read Horizons.ai's blog on CSRMC and continuous validation with NodeZero →
CSRMC and continuous validation: what changes for security teams?
Explore further
02/08/2026 1:15 pm
Continuous proof becomes a governance requirement when environments move faster than review cycles. The article’s central claim is that static assurance no longer matches the operational tempo of modern adversaries. In identity programmes, the same problem appears when entitlements, secrets, and delegated access outlive the conditions that justified them. The practitioner conclusion is clear: security governance must prove current exposure, not preserve historical confidence.
A question worth separating out:
Q: Who is accountable when continuous assurance fails?
A: Accountability sits with the owners of identity governance, the application teams controlling entitlements, and the audit function that relies on the evidence. If controls are fragmented, no single party can prove that access was reviewed, enforced, and remediated in time. The answer is a shared operating model with named control ownership.
👉 Read our full editorial: CSRMC shifts DoD security toward continuous proof, not annual compliance
