News

More than half of national security organizations still move sensitive information by hand, according to The CYBER360: Defending the Digital Battlespace report. That statistic should concern defense and government leaders: manual handling of classified or sensitive material is more than inefficient-it creates systemic security exposures.

Recent intrusions into defense supply chains illustrate how human-driven processes leave exploitable gaps that adversaries can turn into operational advantages. These weaknesses are not merely technical flaws; they represent strategic vulnerabilities for any organization operating in contested environments, where speed and certainty determine mission outcomes.

In a time of rising cyber threats and geopolitical friction, delays and mistakes have real consequences. Errors, slow handoffs, and lax controls can cascade into degraded readiness, flawed decision-making, and broken operational integrity. Manual procedures introduce precisely this kind of uncertainty into situations that require high confidence, creating bottlenecks and multiplying the chance of human error. Put simply, they erode the pillars of mission assurance: velocity, precision, and trust.

Adversaries are aware of these frailties. Each manual step in a data transfer is a potential entry point. In contested operations, such vulnerabilities are operational realities, not hypotheticals.

Why do manual processes remain so common?

The causes are technical, cultural, and organizational.

First, legacy infrastructure is a major impediment. Many government and defense networks run on systems that predate modern automation and were never built to integrate with contemporary policy engines or encryption frameworks. Replacing this gear is expensive and disruptive, so operators insert manual workarounds to bridge gaps.

Procurement timelines make matters worse. Buying and approving new technology in national security contexts is often slow and bureaucratic. By the time a solution clears procurement, the threat landscape has already shifted. Leaders frequently accept manual approaches as temporary fixes that then calcify into standard practice.

Cross-domain complexity adds another challenge. Moving information between classification levels requires strict controls, and historically that control relied on human review. Many officials have considered automation too blunt for nuanced release decisions, even though current tools can apply fine-grained policies without sacrificing discretion.

Culture matters as well. Trusting people to handle sensitive material runs deep in national security institutions. Physical handling-printing, hand-carrying files-feels tangible and controllable, and there is a belief that human oversight reduces risk, despite evidence to the contrary. Regulatory lag also reinforces manual habits: compliance rules often trail technological advances, slowing modernization.

Finally, leaders fear disruption. Missions rarely pause for technology swaps, and decision-makers worry an automation rollout could introduce new errors or interruptions. As a result, organizations cling to known imperfections rather than risk unknown changes.

These factors explain why manual methods persist, but they do not justify staying with them. Threat actors move quickly and opportunistically; the operating environment has changed.

Manual handling carries specific, measurable risks. Human error and variability are inherent: transfers that depend on people vary by team and moment, and even experienced operators are vulnerable to fatigue and overload. Small mistakes can snowball into operational delays or unintended disclosures, and insider risk increases when oversight is trust-based rather than system-enforced.

Policy enforcement also weakens under manual regimes. Automation codifies policy; manual workflows leave rules to human interpretation. Under stress, exceptions become routine and workarounds proliferate, eroding compliance and slowing incident response. That ambiguity also undermines accountability when investigations are needed.

Auditability suffers: manual transfers scatter evidence across emails, sticky notes, and ad hoc logs, making chain-of-custody reconstruction time-consuming and incomplete. Attackers exploit these blind spots, especially when data crosses classification or network boundaries where enforcement is inconsistent.

Operationally, manual processes act as a drag on mission tempo. Each handoff and approval step adds latency, slowing decision cycles. To compensate, operators may skip steps or shortcut controls, introducing fresh risks.

In short, manual methods are fragile: they fail quietly at first and then can fail spectacularly when a crisis exposes the gaps.

Addressing these weaknesses requires more than automating individual tasks. It calls for an architecture that enforces trust, protects data everywhere it lives, and manages boundaries between domains at scale. Defense and government organizations should adopt a three-part approach that secures identity, data, and cross-domain transfers - what we can call the Cybersecurity Trinity.

First, Zero Trust Architecture (ZTA) demands continuous verification of users, devices, and actions. By eliminating implicit trust and enforcing least privilege, ZTA reduces insider risk and enables coalition partners to operate under a consistent trust model, even in fast-moving missions.

Second, Data-Centric Security (DCS) shifts protection from the perimeter to the data itself. DCS uses encryption, persistent classification, and policy enforcement tied to the data so that information remains protected in storage, transit, and use. This approach preserves secure collaboration across heterogeneous networks without slowing operations.

Third, Cross Domain Solutions (CDS) provide controlled mechanisms for transferring information between classification levels and distinct operational domains. Effective CDS enforce release authorities, sanitize content, and prevent unauthorized disclosures-capabilities that are essential for rapid, secure intelligence sharing in coalition operations.

Combined, ZTA, DCS, and CDS form the technical foundation for secure automation. They close the seams that manual processes leave open and make security outcomes measurable and repeatable.

There are special considerations for defense and government environments. CDS implementations must include automated inspection and enforcement of release authorities. Coalition operations need federated identity models and shared standards so partners can interoperate securely. Tactical systems require lightweight agents and resilient synchronization methods for low-bandwidth and intermittently connected contexts. Supply chain risk must be reduced by extending automated verification, attestation, and audit capabilities to contractors and vendors.

In joint missions, manual checks can stall intelligence flows and erode operational tempo. Automation that enforces common standards across participants mitigates those delays. Emerging threats-such as AI-driven attacks and sophisticated deepfakes-make manual verification increasingly obsolete. Automation also reduces opportunities for insider misuse by limiting manual handling and providing detailed, machine-readable audit trails.

Automation does not remove the human element. Instead, it changes roles: people design policies, manage exceptions, analyze alerts, and investigate incidents. Successful adoption depends on investing in training and cultural change. Begin with pilot programs in lower-risk workflows, celebrate early successes, create operator feedback loops, and expand gradually. Clear leadership support and communication are essential; framing automation as mission enabler rather than surveillance helps accelerate acceptance.

Manual handling of sensitive information is a strategic liability that slows missions, creates blind spots, and undermines trust. Automation is not optional-it is essential. Start by identifying high-impact workflows with subject-matter experts, convert policies into enforceable rules, and combine identity, encryption, and audit to measure improvement. Fund the transition, train teams, and track outcomes.

It should not be acceptable that more than half of national security organizations still rely on manual transfers. Your organization does not have to remain in that majority. The next conflict will not wait for paper-based or ad hoc processes to catch up; leaders must act now to harden data flows and make automation a force multiplier.