The Work Behind Secure Modernization: Zero Trust and Platform Engineering

August 25, 2026

SPA Staff

00:00

New technology gets the attention. The harder work comes afterward: securing it, deploying it, and sustaining it in an operational environment. Without the right foundation, even a promising capability may never reach the mission.

Zero Trust and platform engineering address different parts of that challenge. One governs access across the technology environment, and the other creates a secure, repeatable path for delivering software. Both require teams to turn sound technical principles into practices they can apply every day.

In recent articles for WashingtonExec, two SPA technology leaders examine what that work looks like in practice. SPA Chief Information Officer Raj Badhwar explores where organizations struggle with Zero Trust implementation, while SPA DevSecOps and Cloud Fellow Steven Hernandez explains why platform engineering will shape the next wave of modernization.

Putting Zero Trust into Practice

No single product or one-time technology investment can achieve Zero Trust. Effective implementation requires sustained operational discipline as systems, users, and risks evolve.

In “Zero Trust in Practice: What Organizations Get Wrong About Implementation¹,” Raj examines the gap between Zero Trust principles and day-to-day operations. He cautions against vendor-driven shortcuts and recommends starting with manageable segmentation strategies before introducing more complex controls.

Raj also addresses the need to inspect encrypted traffic while protecting sensitive personal traffic. At the center of his approach is identity. Strong authentication, least-privilege access, and permissions that adjust to real-time context give organizations greater control over who can reach critical systems and data.

That control depends on visibility. Organizations cannot secure devices, applications, or user accounts they do not know exist. A reliable, continuously updated asset inventory provides the awareness needed to manage risk and sustain Zero Trust practices over time.

¹The full article originally appeared on WashingtonExec on July 7, 2026.

Why Platform Engineering Matters

Secure software delivery presents another challenge: creating a repeatable path from development to an operational environment. Platform engineering establishes that path through shared infrastructure, automated delivery pipelines, and hardened services that development teams can access through a self-service model.

In “Tech to Watch That Isn’t AI: Platform Engineering and the Next Wave of Modernization²,” Steven argues that these internal platforms will play a central role in determining whether new capabilities reach the mission. In defense environments, that journey includes one of the most demanding parts of software delivery: authorization.

An accredited platform can reduce duplicated work by establishing reusable security controls and automating the evidence required for authorization. Applications built on the platform can inherit common controls rather than starting the process again with each new capability. The result is a delivery process that can move faster without separating speed from security.

The same principle applies to AI. Even the most advanced model depends on an organization’s ability to deploy, monitor, and reauthorize it within a controlled environment. The technology receiving the most attention may change, but every new capability will rely on the strength of the platform beneath it.

²The full article originally appeared on WashingtonExec on July 21, 2026.

SPA’s Software and Cloud Engineering Capability:
Explore how SPA applies DevSecOps, secure cloud architectures, and infrastructure hardening to accelerate the delivery of resilient, mission-ready software.

Raj Badhwar is SPA’s Chief Information Officer and has 30 years of leadership experience in information technology and cybersecurity. He previously held senior cybersecurity roles at Jacobs, Voya Financial, Oracle Cloud, AIG, BAE Systems, and Bank of America. A recognized technology thought leader, Raj has authored six books, co-authored 14 IT and security patents, and frequently speaks on cybersecurity and emerging technology.

Steven Hernandez is SPA’s DevSecOps and Cloud Fellow and has more than a decade of experience in software engineering, enterprise architecture, and DevSecOps. He leads the design and implementation of secure, scalable software and cloud architectures for mission-critical space operations. A US Air Force veteran, Steven brings operational perspective and technical expertise to building resilient platforms, advancing engineering standards, and accelerating the delivery of cloud-enabled capabilities for national security missions.