Every Helicopter, Every AI Agent, Zero Trust

The U.S. Army is racing to verify 5,000 systems—and now weapon systems and AI agents—before a 2027 deadline nobody thinks is easy.

By The Defense Desk

The U.S. Army is working to bring roughly 5,000 IT systems onto a single identity and access platform before an end-of-2027 deadline—and the problem keeps getting bigger [1]. What started as an enterprise IT challenge has spread to weapon systems, industrial control networks, and AI agents that can delegate tasks to other AI agents, each one needing its own verified identity before touching any resource.

The platform at the center of the effort is the Enterprise-Identity, Credential and Access Management system, known as E-ICAM [1]. David Thompson, product lead for E-ICAM at Army CPE Command and Control Information Network, described the core rule as absolute: "Everything, everything that connects to another thing to access a resource has to be positively identified, strongly bound to credential and securely granted access" [1]. That means human users, virtual machines, API calls, and, increasingly, autonomous software agents.

The term the Army uses for the desired security posture is "fine-grain authentication"—where users, devices, data, and AI agents undergo regular steps of authentication to remain logged in [1]. "If the building doesn't have interior doors or desks, we have to secure what we can today with the expectation that we will support the customer's future security improvements tomorrow," he said [1].

Curtis Dukes, executive vice president and general manager of Security Best Practices at the Center for Internet Security, was direct about what legacy systems will require: "There is absolutely going to be a significant amount of technical debt that they're going to have to solve for that," he said [1]. He added that some older systems may have to be updated as part of that movement to the new concept around Zero Trust [1]. Thompson called getting thousands of systems into a Zero Trust posture by the 2027 milestone "a huge goal" [1].

Identity, it turns out, is not a problem you solve once. It is a surface that expands with every new device, every new protocol, every new actor on the network—human or otherwise.

"We're trying to democratize this as much as we possibly can," he said [1]. The catch: Army teams have sometimes discovered that system owners lack complete visibility into their own environments [1].

Mario Puras, senior vice president of Global Solutions Engineering and Architecture at Netskope, argued that Zero Trust must go beyond identity and access control [1]. "The mission fails if user access is secured but the data is compromised," Puras said [1].

AI agents add a layer of complexity that no existing playbook fully addresses. Thompson said the underlying rule does not change for non-human identities—least-privilege access, verified credentials, limited entitlements—but speed does [1]. Automation could shift the pace of malicious activity from "a few attacks per minute" to "hundreds of attacks per second, even thousands per second," he warned [1].

At the tactical edge, the architecture faces a different constraint: connectivity [1]. At brigade and higher, units can reasonably expect connectivity to Army cloud resources. "If Dave Thompson is going to go jump in a helicopter, does Dave Thompson have the authority to turn the helicopter on?" he asked [1].

Thompson's summary of the entire effort doubles as its own deadline pressure: "It's not an end state, it's a continual action" [1]. The Army is driving toward its end-of-2027 deadline for meeting all Zero Trust target milestones across 5,000 systems, with the scope expanding in real time. The identity problem is not waiting for the platform to catch up.

The mission fails if user access is secured but the data is compromised.Mario Puras