Notifications
Clear all
Topic starter
02/08/2026 12:02 pm
TL;DR: Horizon3.ai says NodeZero Federal continuously validates zero trust controls across identity, device, application, data, network, visibility, and governance functions in production federal environments, with mapping to FedRAMP, NIST, CMMC, and DoD activities. Static compliance claims are not enough when attackers can chain identity compromise, lateral movement, and data reachability faster than annual testing can expose the gaps.
NHIMG editorial — based on content published by Horizons.ai: How Horizon3.ai's NodeZero Platform supports the realtime evaluation of zero trust effectiveness for the US federal government
By the numbers:
- The platform can help validate 134 of the 152 DoD Zero Trust activities in real time.
- It supports 79 of the 91 targeted activities as part of continuous monitoring.
Questions worth separating out
Q: What breaks when zero trust is only validated on paper?
A: Paper-only zero trust breaks at runtime.
Q: Why do service accounts and other NHIs complicate GRC implementation?
A: NHIs complicate GRC because they often outnumber human accounts, change outside normal HR-driven lifecycle processes, and carry access that is easy to overlook in reviews.
Q: How do organisations know if zero trust controls are actually working?
A: They know the controls are working when they can inventory privileged identities, prove access is time-bound, and show that rotation and revocation happen on schedule.
Practitioner guidance
- Test identity paths continuously Run attack-path validation against user, admin, and service identities in production-like conditions to confirm that MFA, privilege boundaries, and directory controls actually stop escalation.
- Validate segmentation with real lateral movement attempts Use controlled testing to verify that VLANs, subnets, cloud tenants, and application tiers do not allow a compromised identity to move beyond its intended boundary.
- Measure zero trust with remediation evidence Track whether findings are fixed and re-tested, then report MTTR, recurrence rate, and verified closure rather than only counting detections or policy mappings.
What's in the full article
Horizons.ai's full blog covers the operational detail this post intentionally leaves for the source:
- The specific NodeZero Federal validation workflow for production environments and zero trust control testing.
- The reported mapping across federal frameworks, including DoD zero trust capabilities and NIST 800-53 alignment.
- The continuous retesting workflow used to verify remediation and close the find-fix-verify loop.
- The integration points with ServiceNow, Jira, SIEMs, and the NodeZero API for operational workflows.
👉 Read Horizons.ai's blog on continuous zero trust validation for federal environments →
Zero trust validation for federal teams: are your controls actually working?
Explore further
02/08/2026 1:08 pm
Continuous validation is the real test of zero trust. Zero trust cannot be judged by architecture diagrams, policy language, or audit packets alone. If an attacker can still chain identity abuse into lateral movement, the control model has failed at the point that matters. For practitioners, the programme should be measured by whether attack paths stop in production, not whether the control exists on paper.
A question worth separating out:
Q: Who is accountable when zero trust controls fail to stop unauthorised access?
A: Accountability sits with the identity, access, and platform owners who defined the trust boundary and the revocation process, not just with the security team. In practice, failures usually come from unclear ownership of entitlements, missing lifecycle control for machine identities, or policies that were never tested against real operational conditions.
👉 Read our full editorial: Zero trust validation in federal environments needs continuous proof
