Topic starter
12/07/2026 12:15 pm
TL;DR: Federal agencies are being pushed to meet EDR requirements on mainframes that cannot support endpoint agents, creating a compensating-control problem rather than a tooling problem, according to Illumio. The practical issue is how to secure mission-critical legacy workloads without forcing unsupported architecture changes that weaken Zero Trust outcomes.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “How Illumio Helps Federal Agencies Secure Mainframes”.
Key questions
Q: What should agencies do when EDR cannot run on a mainframe?
A: They should define a compensating control that preserves the original security objective, usually by enforcing workload segmentation, restricting communication paths, and improving monitoring around the legacy system.
Q: Why do mainframes create a compliance gap in endpoint mandates?
A: Because endpoint mandates assume the system can host an agent, collect telemetry, and support response actions locally.
Q: What fails when a Zero Trust programme excludes legacy workloads?
A: The trust boundary becomes incomplete.
Practitioner guidance
- Define compensating controls for unsupported platforms Document the exact control objective that EDR was meant to satisfy, then map the mainframe alternative controls that preserve it through segmentation, policy enforcement, and monitoring.
- Map mainframe communication paths Identify which workloads and services exchange traffic with the mainframe so you can restrict unnecessary paths and reduce lateral movement opportunities.
- Treat legacy systems as Zero Trust scope Include mainframes, IBM Z, iSeries, and similar platforms in the same trust-boundary review as modern workloads, even when control mechanisms differ.
Bottom line: Mainframes expose a real gap between endpoint-based mandates and the systems federal agencies still rely on for mission delivery.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:29 pm
Mainframe security is a Zero Trust governance problem, not a legacy-modernisation debate. The article shows that some federal workloads cannot be forced into endpoint-centric control models without creating blind spots or unsupported architecture. The right question is how to enforce boundary control, visibility, and policy on systems that remain mission-critical. Practitioners should treat legacy coverage as a design requirement, not a temporary exception.
A few things that frame the scale:
- Red Hat’s Kubernetes Security Report found that nearly 9 in 10 organizations had at least 1 container or Kubernetes security incident in the last 12 months.
A question worth separating out:
Q: How should security teams evaluate compensating controls for unsupported systems?
A: They should ask whether the control enforces containment, limits movement, and provides enough evidence to support assurance. If it only documents a policy exception, it has not reduced the underlying risk. The right comparison is not tool parity but control effectiveness against the original threat.
👉 Read our full editorial: Mainframe security exposes the gap in federal EDR mandates