Zero Trust Evolves Beyond Network Perimeters as Microsoft, the Pentagon, and Zscaler Extend the Framework to AI Agents, Weapons Systems, and Data Sovereignty
Microsoft, the Pentagon, and Zscaler are extending zero trust beyond network perimeters to AI agents, weapons systems, and sovereign data flows, driven by a non-human identity explosion that outnumbers human users 100 to 1.
Overview
The zero trust security model — built on the principle that no user, device, or workload should be trusted by default — is entering its most consequential phase of evolution. In the span of ten days in March 2026, three major developments have collectively redefined what zero trust means in practice: Microsoft announced Zero Trust for AI, a framework extending continuous verification to autonomous AI agents and models; the Pentagon continued preparations for its Zero Trust Strategy 2.0, which will for the first time apply zero trust mandates to weapons systems, operational technology, and defense critical infrastructure; and Zscaler expanded its data sovereignty controls across its 160-plus data center network, addressing the tension between global security enforcement and local regulatory compliance.
Taken individually, each announcement is incremental. Taken together, they signal that zero trust is no longer a network-perimeter concept. It is becoming an enterprise-wide governance model that must account for AI autonomy, geopolitical data flows, and systems where downtime is not an option.
Microsoft Adds an AI Pillar to Zero Trust
On March 19, Microsoft introduced what it calls Zero Trust for AI, adding a dedicated AI pillar to its existing zero trust workshop, reference architecture, and assessment tooling. The framework extends the three foundational zero trust principles — verify explicitly, use least privilege, and assume breach — to the full AI lifecycle, from data ingestion and model training through deployment and autonomous agent behavior.
According to Microsoft’s announcement, the updated Zero Trust Workshop now covers 700 security controls across 116 logical groups and 33 functional swim lanes, with the new AI pillar addressing agent governance, data pipeline security, and prompt injection defense. A companion Zero Trust Assessment for AI is in development and scheduled for availability in summer 2026, extending automated evaluation to AI-specific scenarios and controls.
The practical components target three risk domains. Agent governance establishes guardrails for autonomous AI behavior, including approval workflows for high-risk operations. Data security imposes classification, encryption, and access controls across training data pipelines to prevent data poisoning. Prompt security defends against injection attacks — where malicious inputs manipulate AI behavior — and prompt leakage, where sensitive information is extracted through crafted queries.
Microsoft’s framework is not a standalone product but a set of architectural patterns implemented through existing tools: Microsoft Defender, Azure Security Center, and Purview. The day after the ZT4AI announcement, Microsoft published a companion blog post on securing agentic AI end-to-end, and unveiled Agent 365 — a control plane providing visibility into AI agent activity across Defender, Entra, and Purview — with general availability set for May 1.
The timing is deliberate. As CyberScoop reported, AI tools have compressed attack execution timelines to approximately 11 minutes, making human-led defensive responses increasingly impractical. Chase Cunningham, a zero trust analyst quoted in the report, argued that organizations should “treat agents like any other non-human identity” subject to microsegmentation and continuous monitoring.
The Pentagon Extends Zero Trust to Weapons and OT
While Microsoft focuses on enterprise AI, the Department of Defense is preparing to extend zero trust into domains where the original IT-centric framework was never designed to operate. The Pentagon’s Zero Trust Strategy 2.0, estimated to be publicly available around March 2026 according to Randy Resnick, senior advisor for the Pentagon’s Zero Trust Portfolio Management Office, will for the first time apply zero trust mandates to operational technology, internet-of-things systems, defense critical infrastructure, and weapons systems.
The original 2022 strategy focused exclusively on IT infrastructure. It established 91 cybersecurity capability outcomes that all DoD components must meet to achieve target-level zero trust by the end of fiscal 2027, with 61 additional advanced-level outcomes due by fiscal 2032. The updated strategy maintains this tiered structure but extends it to fundamentally different system types. For operational technology, the Pentagon has defined 84 target-level outcomes due by fiscal 2030, with 21 advanced-level outcomes due by fiscal 2033.
The distinction matters because operational technology presents challenges that IT-based zero trust was not built for. As Resnick explained, critical systems controlling water, power, and weapons “you don’t easily shut that down because you’re being attacked.” The Zero Trust Implementation Guideline Primer, published by the DoD in January 2026, reinforces this approach: rather than relying on perimeter defenses, zero trust emphasizes continuous authentication and authorization of every user, device, and application under the principles of “never trust, always verify” and “assume breach.”
Separately, the Pentagon is exploring AI and machine learning to accelerate zero trust compliance assessments. A January 2026 request for information sought commercial platforms capable of simulating cyberattack scenarios, evaluating implementation of all 91 target-level activities, and operating on both unclassified and classified networks — a recognition that the scale of assessment required exceeds what manual purple-team evaluations can deliver before the fiscal 2027 deadline.
Zscaler Addresses the Sovereignty Gap
On March 12, Zscaler announced a significant expansion of data sovereignty capabilities across its Zero Trust Exchange platform. The update addresses a structural tension in cloud-delivered zero trust: the need to inspect and enforce security on traffic globally while keeping data within jurisdictional boundaries.
The expansion introduces in-region SSL inspection and malware analysis, ensuring that encrypted traffic is decrypted and examined locally rather than routed to centralized processing facilities. Zscaler’s architecture separates control, data, and logging planes into distinct layers, allowing each to be hosted independently. The company now operates dedicated control planes in the United States and Europe, with logging planes in six countries, and is extending local control-plane functionality to additional regions including Canada.
For organizations requiring even stricter isolation, Zscaler is offering Private Service Edges — certified single-tenant, customer-hosted appliances — alongside full encryption key control through hardware security module integration. A “Collect Once, Certify All” framework maps a single set of security controls to overlapping compliance requirements across GDPR, NIS2, and DoD IL5.
Misha Kuperman, Zscaler’s chief reliability officer, stated that “the true measure of a security cloud isn’t just global performance, but its ability to adapt to local realities.” The announcement reflects a broader market recognition that zero trust enforcement requires geographic granularity, not just logical segmentation.
The Non-Human Identity Problem
Underlying all three developments is a common driver: the explosion of non-human identities. According to CSO Online’s analysis of non-human identity risks, organizations now manage a 100-to-1 ratio of machine and non-human identity counts compared to human users, with some sectors reporting ratios as high as 500-to-1. Autonomous AI agents with administrative privileges now represent a new insider threat vector.
The scope of the exposure is stark. According to CSO Online, 97 percent of non-human identities have excessive privileges, and just 0.01 percent of machine identities control 80 percent of cloud resources — meaning compromise of a single over-privileged service account could grant an attacker effective ownership of an entire environment. Orphaned identities grew 40 percent year-over-year, and GitGuardian detected 13 million secrets in public GitHub repositories. Security leaders surveyed by Tenable and Delinea predicted that 2026 will see the first major breach caused by an over-privileged AI agent — an attack that would not appear as a traditional intrusion because it would operate within the agent’s legitimate access boundaries.
Gartner has projected that 50 percent of organizations will adopt zero-trust data governance by 2028, driven in part by the rise of unverified AI-generated data. The firm described this as potentially catalyzing a new security practice area: continuous model behavior evaluation.
What It Means
The convergence of these announcements illustrates a fundamental shift in what zero trust is asked to protect. The model was conceived to eliminate implicit trust in network location. It is now being asked to govern entities that have no physical location at all — AI agents that traverse cloud boundaries, autonomous weapons systems that cannot tolerate downtime, and data flows that must simultaneously comply with conflicting jurisdictional requirements.
The challenge is execution. Microsoft’s ZT4AI framework depends on organizations instrumenting their AI pipelines with identity, access, and monitoring controls that many enterprises have not yet deployed for conventional workloads. The Pentagon’s OT-specific outcomes acknowledge that critical systems cannot simply be “shut down because you’re being attacked,” requiring continuous verification models that operate without disrupting operations. Zscaler’s sovereignty expansion addresses data residency but introduces architectural complexity that smaller organizations may struggle to manage.
The 100-to-1 ratio of non-human to human identities frames the scale of the problem. Every API key, service account, AI agent, and automated workflow represents a potential trust boundary that zero trust must continuously evaluate. The next phase of zero trust is not about building higher walls — it is about extending verification to entities that were never designed to be verified.