Elodie Collins 
The Department of War is accelerating zero trust implementation to meet its 2027 deadline, but securing operational technology and Internet of Things, or IoT, remains a challenge for the Pentagon, according to Ryan McArthur, federal chief technology officer at Zscaler.
In an article published on Defense Opinion, McArthur, a retired U.S. Army chief warrant officer, discusses what the Pentagon can do to close cybersecurity gaps related to OT and IoT.
Government data has become a primary attack surface for international conflict. Learn about the threats targeting American systems and get updates on the zero trust journeys across the federal government at the Potomac Officers Club’s 2026 Cyber Summit on May 21. Get your tickets today.
How Can the Pentagon Implement Zero Trust in IoT Systems?
In the blog post, McArthur explained that IoT and OT devices typically operate using legacy protocols and lack encryption, making securing these systems more complex.
A zero trust architecture, he said, authenticates, authorizes and continuously monitors all devices, from tactical sensors to industrial controllers. Access is granted after verifying identity and is limited to only what is necessary.
He also put forward a security practice called microsegmentation, which isolates workloads, applications and devices into small units within a network to limit lateral movement and enable operators to quickly contain compromised devices. If an IoT sensor is hijacked during a mission, microsegmentation can restrict the threat and prevent it from reaching sensitive systems or disrupting operations.
How Is Zscaler Supporting Government Cybersecurity?
Zscaler is a cloud security company based in San Jose, California. The firm recently announced its partnership with Peraton to offer cybersecurity and network modernization services for mission-critical government and enterprise environments.
Under the partnership, Zscaler will contribute its Zero Trust Exchange platform to connect users and devices to applications using identity and context instead of network access.
