CISA Mandated Continuous Authentication. PKI Cannot Deliver It.

On April 9, 2026, the Cybersecurity and Infrastructure Security Agency issued a binding operational directive requiring all federal civilian agencies to fully implement Zero Trust Architecture by December 31, 2026. Quarterly compliance milestones. Encrypted DNS and HTTPS-only internal traffic by Q4. All internal applications behind identity-aware proxies by Q3. Microsegmentation for all sensitive data environments. And, in the language that has attracted the most attention from security architects, continuous authentication replacing session-based access for privileged accounts.

Read that last phrase carefully. It is not a recommendation about how certificates should be configured. It is a structural statement about what authentication should be. Continuous, not session-bounded. Replacing, not augmenting. That is a description of a different architecture, not a tuning parameter for the existing one.

What CISA Actually Required

The directive operationalizes OMB M-22-09, the 2022 federal Zero Trust strategy, and sets enforcement teeth on a vision that has been moving slowly across the federal estate for four years. The specifics matter. Q3 2026: all internal agency applications sit behind identity-aware proxies. Q4 2026: encrypted DNS and HTTPS-only traffic on internal networks. Microsegmentation for every environment containing sensitive data. Continuous authentication, not session-based access, for privileged accounts. Full implementation by December 31, 2026.

The GAO has estimated the government-wide cost at roughly $9.8 billion. The directive itself acknowledges a structural problem: a meaningful portion of the federal IT estate runs on 1990s-era systems that cannot support modern authentication mechanisms. That acknowledgment is doing quiet but important work. It concedes that the existing identity architecture does not reach the systems Zero Trust most needs to protect.

Continuous Authentication Is Not a PKI Feature

PKI authenticates at session start. A client presents a certificate. The certificate is validated against a CA trust chain. A session is established. For the lifetime of that session, often minutes, hours, or longer, the initial authentication event stands in for ongoing trust. That is, by design, session-based access. It is what certificates are built to do.

Continuous authentication is a different primitive. It requires that trust be re-established, cryptographically, across a stream of transactions rather than at a single handshake. You can approximate it by layering tooling on top of PKI, forcing frequent re-authentication, rotating short-lived certificates, pushing policy checks into identity-aware proxies, but what you end up with is a PKI deployment trying to behave like something it was never architected to be. The ceiling on that approach is low. The operational cost is high.

AKM was architected for continuous authentication from the start. Symmetric keys refresh every session, autonomously, without CA involvement. Every packet is independently verified. There is no initial handshake that does the heavy lifting and then stands aside. Trust is re-established cryptographically, continuously, as an architectural property.

Microsegmentation Without the PKI Overhead

The directive's microsegmentation requirement has been the second-most-discussed element in federal security circles. Microsegmentation at scale is hard. PKI-based microsegmentation is harder. Every segment boundary becomes another certificate lifecycle to manage, another set of trust relationships to revoke and reissue when things change.

AKM collapses that overhead. Segment boundaries are enforced at the protocol layer through session-bound key material, not through certificate-based trust anchors that have to be provisioned, rotated, and revoked per segment. Adding or redrawing segments does not require a CA round trip. It is a configuration change, not a lifecycle event.

The 1990s Problem Is Real, and It Favors AKM

CISA's acknowledgment that a meaningful slice of federal systems cannot support modern authentication is a real constraint, and it is the part of the directive where retrofit strategies run out of options. You cannot put a full PKI stack on a controller from 1997. You cannot push certificate lifecycle management into an air-gapped tactical system that does not have CA reachability. You cannot microsegment a legacy environment by adding infrastructure it cannot run.

AKM was designed for these systems. The SDK is under 50KB. It runs without CA dependency. It operates air-gap capable. It fits constrained industrial devices and legacy federal hardware that PKI was never deployable on. For agencies facing the December 31 deadline with a mixed fleet of modern and legacy assets, that footprint is not a nice-to-have. It is the difference between a directive-compliant architecture and a directive-compliant memo.

Eight Months Costs What

Between April 9 and December 31 is roughly eight months. Standard federal procurement cycles for new security architecture typically run longer than that. Agencies already well into their Zero Trust programs will push hard to bring existing deployments into compliance. Agencies still in vendor selection should weigh the architectural question, not only the tool question.

The directive does not specify a technology. It specifies an outcome. Continuous authentication. Microsegmentation. Encrypted internal traffic. No session-based access for privileged accounts. Agencies that select tooling built to deliver those outcomes natively, instead of tooling retrofitted to imitate them, reduce both the December 31 exposure and the architectural debt they will carry into the next directive.

Compliance vs. Architecture

There will be federal agencies that hit the December 31 deadline by stacking tooling on top of PKI. Their compliance posture will check the boxes. Their architecture will remain session-based at the cryptographic layer, with continuous authentication simulated at the policy layer above. It will work, in the narrow sense. It will not be what the directive actually describes.

There will also be agencies that take the directive as the prompt it is: a signal that the federal government is moving, structurally, toward an identity model PKI was never built to deliver. For those agencies, replacing PKI with Autonomous Key Management^™  is not a compliance shortcut. It is the architectural path to what comes after December 31, and after the next directive, and the one after that.

CISA mandated continuous authentication. PKI cannot deliver it. AKM can, and does, by design.

About AKMSecure

AKMSecure delivers a patented Autonomous Key Management^™ protocol built to replace outdated PKI approaches with a dynamic, quantum-secure, air-gapped-capable architecture. Instead of relying on persistent credentials that can be stolen, reused, or abused, AKM enables independently verified sessions with no standing privileges left behind. The result is a model that better aligns with Zero Trust principles, reduces certificate-based risk, and supports resilient operations across enterprise IT, OT and Tactical Edge environments. Built to NSA-grade security standards and deployable as a lightweight SDK, AKMSecure helps organizations modernize trust at the protocol layer without rebuilding everything around it.