The Next Phase of Zero Trust: From Recognizing Known Threats to Stopping Threats

Why It Matters

Shifting from threat recognition to threat stoppage will reduce breach windows and lower the cost of incident response across the federal enterprise, preserving national security and public trust.

Key Takeaways

• M‑22‑09 anchored federal cyber goals to measurable controls like phishing‑resistant MFA.
• EvilTokens exploits legitimate OAuth flow, bypassing credentials and MFA.
• AI‑enabled phishing yields 54% click‑through, 450% higher than traditional.
• AI‑native systems model expected behavior to stop unknown threats.
• Policy should prioritize outcome metrics, autonomous response, and high‑value logging.

Pulse Analysis

The 2022 Federal Zero Trust Strategy marked a watershed moment for U.S. government cybersecurity, translating abstract principles into concrete controls such as phishing‑resistant multi‑factor authentication and endpoint detection. By tying progress to measurable guardrails, agencies gained a shared language and oversight mechanisms, but the strategy’s emphasis on known‑threat detection has become a ceiling as adversaries adopt fast‑moving, novel techniques that slip past static defenses.

Artificial‑intelligence‑native security platforms are redefining that ceiling. Unlike rule‑based tools that wait for a threat to be cataloged, AI models expected user and system behavior, flagging deviations before an attack fully materializes. The EvilTokens campaign illustrates the danger: it hijacks Microsoft’s OAuth device‑code flow, sidestepping both passwords and MFA, and can persist for weeks. Moreover, Microsoft reports AI‑enabled phishing achieving a 54% click‑through rate—roughly 450% higher than conventional phishing—underscoring the urgency of moving from detection to outright prevention.

Policy makers are urged to recalibrate zero‑trust guidance toward outcome‑oriented capabilities, such as reduced mean time to detect and remediate, and to formally endorse autonomous decision‑making within auditable bounds. Modernizing logging to focus on high‑value signals rather than sheer volume will further empower AI systems to prioritize real risk. These shifts promise a more resilient federal cyber posture, where agencies can stop attacks in real time regardless of novelty, thereby safeguarding critical infrastructure and public confidence.