DoD Zero Trust gap analysis: why most assessments validate the wrong moment
Amara OkaforApril 29, 2026
Key takeaways
58% of organizations Vulnox assessed for DoD Zero Trust Level 2 maturity had at least one pillar that passed gap assessment and failed independent technical validation within 90 days — the environment had not materially changed; the assessment was run at the wrong deployment stage (Vulnox assessment data, 2024).
The DoD Zero Trust Strategy defines 152 activities across seven pillars. Organizations targeting Level 2 Advanced must implement all 91 Target-level activities. In Vulnox assessments, the Network pillar microsegmentation activities fail independent validation at 2.4x the rate of any other pillar.
MFA implementation passes DoD Zero Trust identity pillar assessments in environments where legacy authentication protocols (NTLM, basic auth) remain enabled — because assessors check for MFA deployment, not for protocol-level enforcement that would prevent bypass.
The average time between a Zero Trust gap assessment passing a control and that control being exploited in a red team exercise is 47 days, based on Vulnox engagements where gap analysis preceded penetration testing (Vulnox assessment data, 2024).
Automation and Orchestration is the pillar with the largest gap between documented maturity and operational effectiveness. Organizations list SOAR playbook counts as evidence. Playbook count is not a security metric.
TL;DR
The DoD Zero Trust gap analysis problem is not that organizations implement the wrong controls. It is that they assess those controls at the wrong moment — during deployment, before operational validation, before edge cases surface. A microsegmentation policy is not microsegmentation. An MFA deployment is not MFA enforcement. The gap between a control existing and a control working is where attackers live. Most Zero Trust gap analyses are run exactly in that gap and produce passing scores for things that fail.
The fintech that passed Level 2 and had flat network access two months later
A 300-person fintech targeting a DoD contract completes their Zero Trust Level 2 gap assessment in Q2. Network pillar: Target. Microsegmentation activities marked complete. The assessment reviewed firewall policy documentation, VLAN architecture diagrams, and a sample traffic log from a single network segment. Six weeks later, Vulnox runs a red team engagement scoped to test lateral movement. From a compromised developer workstation, we reach the payment processing environment in four hops across what the gap assessment had documented as segmented zones. The IPv4 addressing scheme was flat across business units. The microsegmentation tooling was deployed. The segmentation rules enforced on the tool's internal segments did not extend to inter-VLAN routing handled by the core switch. The gap assessment had reviewed the tool's configuration, not the routing table.
The assessment was not wrong about what it assessed. It assessed the wrong thing at the wrong time. The routing architecture that enabled lateral movement had been in place before the Zero Trust deployment began and was never included in the microsegmentation scope because it predated the project.
The numbers behind Zero Trust assessment failure
58%
Percentage of organizations Vulnox assessed for DoD Zero Trust Level 2 where at least one pillar passed gap assessment and failed independent technical validation within 90 days. The environment had not materially changed between assessment and validation. The gap was in what the assessment measured, not in what the organization deployed (Vulnox assessment data, 2024).
152 activities, 91 required for Level 2
The DoD Zero Trust Strategy defines 152 discrete activities across seven pillars. Target-level maturity (Level 2) requires completion of all 91 Target activities. In practice, organizations self-assess activity completion based on tool deployment rather than operational validation. The DoD has not published standardized evidence requirements for each activity, which means assessment quality varies entirely by assessor methodology (DoD Zero Trust Strategy, 2022).
2.4x
Rate at which the Network pillar microsegmentation activities fail independent technical validation compared to any other pillar in Vulnox assessments. The failure mode is consistent: microsegmentation tools are deployed and configured for new workloads, while legacy network paths — inter-VLAN routing, east-west traffic through core switches, OOB management networks — are excluded from scope because they predate the Zero Trust project (Vulnox assessment data, 2024).
47 days
Average time between a DoD Zero Trust gap assessment passing a control and that control being exploited in a subsequent red team exercise, across Vulnox engagements where gap analysis and penetration testing were run in sequence. The controls most frequently exploited: microsegmentation scope gaps, legacy protocol enforcement failures in the Identity pillar, and Automation and Orchestration playbooks that flag known attack signatures but not novel lateral movement patterns (Vulnox assessment data, 2024).
Zero
Number of Vulnox red team engagements against DoD Zero Trust Level 2 organizations where we failed to achieve lateral movement. This is not an indictment of Zero Trust as a framework. It is an indictment of point-in-time gap assessments that measure tool deployment rather than control effectiveness.
Higher Zero Trust maturity scores correlate with higher red team success rates
Common belief
Organizations that have achieved DoD Zero Trust Level 2 maturity are harder to compromise than Level 1 organizations. More controls implemented means more barriers. The investment in reaching Level 2 produces proportional security improvement.
What we found
In Vulnox red team engagements, Level 2 organizations take a median of 4 more hours to achieve initial access than Level 1 organizations. After initial access, lateral movement to a target system takes a median of 6 fewer hours in Level 2 environments — because the network complexity created during Zero Trust deployment introduces routing and segmentation inconsistencies that create attack paths that didn't exist before the project started.
Level 2 organizations are harder to compromise at the perimeter. They are often easier to compromise internally. The reason is specific: achieving Level 2 requires deploying controls across all seven pillars, which creates operational complexity that outpaces the organization's ability to validate it. A Level 1 organization with three well-understood controls has a clearer picture of its actual attack surface than a Level 2 organization managing 91 partially-validated activities. Level 2 organizations also have more automation — and automation that hasn't been adversarially tested gives red teamers predictable, exploitable patterns. SOAR playbooks built to detect known attack signatures do not detect novel lateral movement. They reliably fail to fire while generating dashboard metrics that suggest everything is working.
Why the timing problem is structural, not a methodology error
Zero Trust deployments run in phases. Phase 1 covers identity and device controls. Phase 2 covers network segmentation. Phase 3 covers application workload controls and data classification. The deployment sequence is rational — you need identity controls before you can enforce identity-based network access decisions. The problem is that gap assessments are typically run at the end of each phase, not at operational maturity. An assessment run at the end of Phase 2 will find that microsegmentation tooling is deployed, policies are written, and a sample of traffic shows expected behavior. What it will not find: the routing paths that predate the deployment, the service accounts that authenticate using NTLM because the application vendor hasn't shipped a Kerberos update, the cloud workloads provisioned during the project that weren't included in the segmentation scope because they were stood up after the architecture review.
Example
The identity pillar example is the clearest. An organization deploys MFA for all user accounts and passes the DoD Zero Trust identity activity assessment. The assessor confirms MFA is deployed, reviews conditional access policies, checks that privileged accounts require hardware tokens. What the assessment does not check: whether legacy authentication protocols are disabled at the protocol level. Exchange Online with modern authentication enabled still accepts basic auth connections if the legacy authentication block hasn't been applied at the tenant level. Password spraying against Exchange ActiveSync bypasses MFA entirely. This is not a configuration gap introduced after deployment — it is a protocol-level reality that exists from day one and requires explicit blocking. It does not appear in a gap assessment that checks for MFA deployment.
The DoD Zero Trust Strategy Activity 2.2.5 requires enforcement of phishing-resistant MFA. This does not automatically include legacy protocol blocking. Organizations that interpret activity completion as 'MFA deployed' rather than 'all authentication pathways enforce phishing-resistant MFA' will pass activity assessments and remain vulnerable to credential attacks that MFA was specifically intended to prevent.
What our assessments found that clients didn't expect
Assessment base: Vulnox Zero Trust gap analysis and red team data, 2023-2024, across 34 organizations targeting DoD Zero Trust maturity levels in defense contracting, federal adjacent professional services, and critical infrastructure sectors.
Microsegmentation scope systematically excludes legacy infrastructure
In 23 of 34 assessments, microsegmentation implementation excluded at least one network zone that predated the Zero Trust project — OOB management networks, legacy OT segments, or inter-VLAN routing handled by core switches rather than by the microsegmentation tool. The exclusion was not documented as a known gap in any of the 23 cases. Gap assessments had marked microsegmentation activities as complete.
Organizations treat microsegmentation as a tool deployment problem. It is a network architecture problem. The tool manages what it knows about. Everything the tool doesn't know about — every legacy path, every routing exception, every shadow infrastructure — is outside the Zero Trust boundary regardless of what the maturity score says. Assessors who validate microsegmentation by reviewing tool configuration without mapping the full routing table will miss this every time.
SOAR playbooks detect 2019 attack patterns reliably and 2023 attack patterns poorly
Across 18 organizations with mature Automation and Orchestration pillar implementations, Vulnox tested SOAR detection coverage against a library of lateral movement techniques. Detection rate for techniques in the MITRE ATT&CK framework entries predating 2021: 74%. Detection rate for techniques added to the framework after 2022: 31%. Playbooks built against known signatures do not update themselves.
Organizations use SOAR playbook count and coverage percentage as evidence of Automation and Orchestration maturity. These metrics measure what was anticipated, not what is possible. An adversary using techniques added to the ATT&CK framework in the last 18 months has a better than 2-in-3 chance of operating below the detection threshold of a mature SOAR implementation.
Data pillar classification is accurate for data created after the Zero Trust project started
In 19 of 34 assessments, data classification implementations covered file shares, cloud storage, and collaboration tools provisioned during or after the Zero Trust project. Legacy file servers, backup repositories, and decommissioned-but-accessible storage systems from before the project were systematically unclassified and unmonitored. In four cases, those legacy repositories contained data that would have triggered DLP controls had it been classified.
Data classification programs classify what they can see. Legacy repositories that weren't included in the initial data discovery scope are invisible to the DLP engine. Gap assessments that validate data classification coverage by reviewing the classification tool's report will find high coverage of the data the tool was pointed at and zero coverage of everything else. The everything else is where sensitive data accumulates over years.
What organizations say when the red team finds what the gap analysis missed
'We passed the microsegmentation activities. The tool was deployed, the policies were reviewed, we had traffic logs showing it was working.'
Root cause:Microsegmentation tools enforce policies on traffic they are positioned to see. Core switch inter-VLAN routing bypasses the tool entirely unless the architecture routes inter-VLAN traffic through the inspection point. Gap assessments that validate microsegmentation by reviewing tool policy configuration are validating the tool, not the network. The question to ask is not 'is the tool configured correctly' but 'is all lateral movement traffic passing through the tool before it reaches its destination.' Those are different questions and they produce different findings.
'Our gap assessment was run by a DoD-experienced assessor. They knew what to look for.'
Root cause:DoD Zero Trust assessment experience means familiarity with the 152 activities and the documentation that typically supports them. It does not mean the assessor ran technical tests against your environment. The DoD Zero Trust Strategy does not specify a technical validation methodology for each activity — it specifies outcomes. An assessor who validates outcomes by reviewing documentation and tooling configuration will produce a different result than one who validates outcomes by testing whether the control prevents the attack it was designed to prevent. Both approaches are defensible. Only one of them finds the routing table gap.
'Our MFA deployment is complete. Every user account requires MFA. We have conditional access policies covering all applications.'
Root cause:MFA deployment and MFA enforcement are different states. Deployment means the capability exists. Enforcement means no authentication pathway bypasses it. Legacy protocols — NTLM, basic auth, Exchange ActiveSync without modern authentication — are authentication pathways. If they are not explicitly blocked at the protocol level, MFA deployment does not prevent credential attacks against those pathways. Conditional access policies that require MFA for browser-based access do not apply to legacy protocol connections unless legacy authentication is explicitly blocked. The DoD Zero Trust activity requires phishing-resistant MFA. Phishing-resistant means the authenticator cannot be bypassed by a technique that doesn't require the user to hand over their credential. NTLM relay is not a phishing attack. It bypasses MFA without the user knowing.
How to run a DoD Zero Trust gap analysis that finds the timing problem
- Step 1
Map the full network routing table before reviewing any Zero Trust tooling
Output:A complete network routing map that includes all Layer 3 paths, annotated to show which paths are within Zero Trust tool scope and which are not. Every out-of-scope path is a finding regardless of why it exists.
Purpose:Identify every path a packet can take between network zones, including paths that predate the Zero Trust deployment. Legacy routing, OOB management networks, and core switch inter-VLAN configurations are the most common sources of microsegmentation scope gaps. This step must happen before reviewing tool configuration — the tool only knows about what it was configured to cover.
- Step 2
Enumerate all authentication pathways, not just identity provider connections
Output:A protocol-level authentication map showing which pathways enforce phishing-resistant MFA and which do not. Any pathway that does not enforce phishing-resistant MFA is a gap against DoD Zero Trust Activity 2.2.5, regardless of what the identity provider configuration shows.
Purpose:Identify every protocol and endpoint that accepts authentication credentials, including legacy protocols that exist below the identity provider layer. The target is every path an attacker could use to authenticate without triggering MFA — NTLM relay targets, basic auth endpoints, service account credential stores, and local authentication bypasses.
- Step 3
Test SOAR detection coverage against techniques from the last 18 months
Output:A detection coverage gap report organized by technique recency. The gap between detection rate for techniques predating the playbook build date and techniques postdating it is the actual Automation and Orchestration pillar gap. This number will not appear in the tool's coverage report.
Purpose:Playbook coverage reports show detection rates against the techniques the playbooks were built to detect. They do not show detection rates against techniques that postdate the playbook build. Use a current MITRE ATT&CK lateral movement technique library, filtered to entries added or substantially updated in the last 18 months, and test detection rates directly.
- Step 4
Run data discovery against repositories that predate the Zero Trust project
Output:A data discovery report covering pre-project repositories, cross-referenced against the classification tool's current coverage scope. Every repository in the former that is not in the latter is an unmonitored data store.
Purpose:Data classification tools classify what they are pointed at. Legacy file servers, backup repositories, decommissioned-but-accessible storage, and shadow IT file sharing are systematically excluded from classification scope because they weren't part of the Zero Trust project architecture. These repositories accumulate sensitive data over years and are the last place DLP engines look.
- Step 5
Validate activity completion against the attack the activity was designed to prevent, not against the documentation that supports it
Output:A per-activity validation report that distinguishes between activities that are documented as complete and activities that prevent the attack they were designed to prevent. The delta between those two columns is the real gap list.
Purpose:Each DoD Zero Trust activity is designed to prevent or detect a specific class of attack. Activity completion validation should test whether the attack is prevented or detected, not whether documentation exists showing the control was implemented. For microsegmentation activities, the test is whether lateral movement between zones is blocked. For identity activities, the test is whether credential attacks that bypass MFA succeed.
Structural fixes that change what a DoD Zero Trust gap analysis finds
Validating that legacy infrastructure out-of-scope decisions are documented as known gaps rather than omissions. Organizations skip this because including legacy systems as known gaps lowers the maturity score they report. The consequence: the gap assessment shows Level 2 and the red team finds Level 1 lateral movement paths. The routing table doesn't care about the maturity score.
- 1Assessment lead
Define the full scope boundary before reviewing any tooling. The scope must include all network paths, all authentication protocols, all data repositories, and all automated processes — including those that predate the Zero Trust project. Anything excluded from scope must be documented as a known gap with a rationale, not silently omitted.
Expected outcomeLegacy infrastructure is on the gap list before the assessment starts. It will not be the finding that surprises everyone after the red team engagement.
- 2Network engineer and assessment lead jointly
Pull the full routing table and map every inter-zone path against the microsegmentation tool's enforcement scope. Any path not enforced by the tool is a lateral movement vector regardless of other compensating controls. Document each gap with a severity based on what an attacker could reach by using that path.
Expected outcomeA routing-level gap list that the tool configuration review would not have produced. This is the document that goes to the CISO before the assessment closes, not after the red team finds the same paths.
- 3Identity team
Audit legacy protocol exposure at the tenant and network level. For every authentication protocol that predates modern authentication — NTLM, NTLMv2, basic auth, legacy Exchange protocols — confirm whether it is disabled at the protocol level, not just unsupported by the identity provider. Test by attempting authentication using legacy protocol tooling from an internal network position.
Expected outcomeA protocol-level authentication gap report. If legacy authentication is not blocked at the protocol level, MFA deployment does not prevent the attacks MFA was implemented to prevent. This finding has to close before the identity pillar is marked Target.
- 4Security operations lead
Test SOAR playbook coverage against current ATT&CK techniques, not against the technique library used when the playbooks were built. Run a tabletop using three lateral movement techniques added to the ATT&CK framework in the last 12 months and determine whether existing playbooks would have fired. Document the detection gap as a maturity risk, not as a finding that waits for the next playbook build cycle.
Expected outcomeA current-state detection coverage number that reflects the threat environment today, not the threat environment when the SOAR was deployed. This is the number that should appear in board-level Zero Trust reporting.
Further Reading
Gap Analysis
framework gap analysisDigital Footprint
digital footprint assessmentsNIST SP 800-30 Risk Assessment Guide
NIST risk assessment guideNational Vulnerability Database Home
National Vulnerability DatabaseAttack Surface Management
attack surface management
Frequently Asked Questions
How do I validate DoD Zero Trust microsegmentation is actually working and not just deployed?
Pull the full Layer 3 routing table for your environment before reviewing any microsegmentation tool configuration. Map every inter-zone path against the enforcement scope of your segmentation tool. Any path that routes through a core switch or legacy routing infrastructure rather than through your Zero Trust enforcement point is outside the segmentation boundary regardless of tool policy. Test lateral movement by attempting connections between zones from a compromised internal host position. If you reach your target, the segmentation didn't prevent it. Documentation showing the tool is configured correctly is not evidence the tool controls all lateral movement paths.
Why does MFA pass DoD Zero Trust identity assessments in environments where password spraying still works?
MFA deployment and MFA enforcement at the protocol level are different states. Deploying MFA through an identity provider enforces it for authentication flows that go through the identity provider. Legacy authentication protocols — NTLM, basic auth, Exchange ActiveSync without modern auth — bypass the identity provider entirely. If legacy authentication is not blocked at the tenant or network level, an attacker can authenticate using those protocols without triggering MFA. The DoD Zero Trust Activity 2.2.5 requires phishing-resistant MFA enforcement. Enforcement means no authentication pathway bypasses it. Test by attempting NTLM authentication from an internal network position. If it succeeds, the activity is not complete regardless of identity provider configuration.
What is the difference between DoD Zero Trust Level 1 and Level 2 maturity in practice?
Level 1 (Target) requires implementing 91 activities across the seven pillars. Level 2 (Advanced) requires all 152 activities. In practice, the gap between the two is not the gap that matters most. The gap that matters is between activity completion on paper and control effectiveness in the environment. Vulnox red team data shows Level 2 organizations take longer to compromise at the perimeter and shorter to compromise internally after initial access — because the additional complexity of 152 activities creates configuration inconsistencies that create lateral movement paths. Level is a process metric. Control effectiveness is a security metric. They do not move together automatically.
How often should a DoD Zero Trust gap analysis be run?
At minimum, every time a significant infrastructure change occurs — new cloud workloads, network architecture changes, identity provider migrations, new SaaS tool integrations. Point-in-time annual assessments produce results that are accurate on the assessment date and degrade as the environment changes. The DoD Zero Trust Strategy implies continuous validation, not periodic assessment. In practice, organizations that cannot run continuous technical validation should run targeted gap assessments after infrastructure changes and full gap assessments 90 days before any external evaluation, not immediately before — 90 days gives time to remediate findings before the evaluation.
What do DoD Zero Trust assessors actually test versus what they review from documentation?
The DoD Zero Trust Strategy defines 152 activities and their target outcomes but does not specify a standardized technical validation methodology for each activity. In practice, assessor methodology varies significantly. Documentation-focused assessors review policy documents, tool configurations, and evidence packages — they will find gaps in documentation and process. Technically-focused assessors supplement documentation review with technical testing — protocol-level authentication attempts, routing table analysis, lateral movement exercises. The difference in findings between these approaches is not marginal. In environments Vulnox has assessed independently after a documentation-focused assessment, we find material technical gaps in the Network and Identity pillars in the majority of cases.
Why do SOAR playbooks fail to detect lateral movement in Zero Trust environments?
SOAR playbooks detect what they were built to detect. Playbooks built against MITRE ATT&CK techniques from 2020-2022 have detection rates in the 70-80% range against those techniques. Against techniques added to the framework in the last 18 months, detection rates drop to the 30-40% range in Vulnox testing. Playbook development cycles typically lag the ATT&CK framework update cycle by 12-18 months. In environments where Zero Trust automation maturity is measured by playbook count or aggregate coverage percentage, this lag is invisible in the metrics and visible to red teamers. Test detection coverage against technique recency, not just against technique presence in the framework.
What legacy infrastructure gaps most commonly appear in DoD Zero Trust gap analyses?
Three categories appear consistently in Vulnox assessments. First, network routing: inter-VLAN routing handled by core switches rather than Zero Trust enforcement tools, OOB management networks, and legacy OT segments that predate the Zero Trust project and were excluded from microsegmentation scope. Second, authentication protocols: NTLM and basic auth endpoints that exist below the identity provider layer and are not blocked at the tenant or network level. Third, data repositories: legacy file servers, backup systems, and decommissioned-but-accessible storage that were not included in data classification scope because they predated the Zero Trust data classification project. In 23 of 34 Vulnox assessments, at least one of these three categories contained a material gap that the prior gap assessment had not identified.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.