You’re only as secure as your last evaluation

The updated Cybersecurity Maturity Model Certification (CMMC) represents a critical evolution in the Department of War (DoW) strategy to secure the Defense Industrial Base (DIB). It is more than a regulatory hurdle. It is a direct response to a rapidly changing and increasingly hostile threat landscape faced by the DIB.

Updated CMMC guidance issued in 2025 simplifies the prior framework, focusing on the most essential security practices aligned with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. Its fundamental purpose remains unchanged: to protect sensitive, unclassified defense information — specifically Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) — from foreign adversaries.

The updated CMMC phases. Image from ™ enables a more continuous approach to security validation. Unlike traditional penetration testing or vulnerability scanning, NodeZero identifies and validates exploitable weaknesses and demonstrates how they can be chained together.

This provides organizations with the ability to:

• Validate controls regularly: Demonstrate effectiveness on an ongoing basis, not just during audits





• Close the compliance gap: Move beyond documentation to show how controls mitigate real-world risk





• Identify attack paths: Understand how an adversary could move through the environment

This approach supports a more realistic understanding of security posture and risk.

Expanding the scope: From enterprise to ecosystem

Elevating supply chain security for FCI and CUI represents a broader shift in how the DoW approaches risk. The focus is no longer limited to securing individual networks. It extends across the entire DIB ecosystem.

The objective is not only compliance, but:

• Measurable risk reduction





• Greater resilience across interconnected environments





• Assurance of mission continuity

Implications for prime contractors

CMMC reinforces a long-standing reality: The security posture of a prime contractor is directly influenced by the posture of its suppliers.

This introduces cascading risks across the supply chain, particularly where subcontractors process, store, or transmit CUI.

Key implications include:

• Jeopardized prime contractor posture: A security incident at a supplier can impact the prime’s certification.





• Contract ineligibility and business impact: Non-compliance may lead to disqualification from DoW contracts.





• Mission assurance risk: Compromised CUI can affect operational integrity and outcomes

Common sources of compromise

Compromise often originates in predictable areas of the supply chain.

Third-party providers. Managed service providers (MSPs) and vendors supporting multiple organizations can introduce systemic risk. A single compromise can expose multiple environments.

Specialized suppliers. Small and medium-sized organizations may handle sensitive data but lack enterprise-grade security controls.

Interconnected access points. Common weaknesses include:

• Shared credentials





• Weak or misconfigured VPN access





• Federated identity systems without proper segmentation

Example: Assume-breach scenario

In a recent assume-breach test, NodeZero began with access to a single host without credentials. From that starting point, it enumerated domain users and executed a password spray, successfully obtaining a valid domain credential.

That account had local administrator privileges, enabling further actions:

• Deployment of a remote access tool (RAT)





• LSASS access and credential harvesting

This scenario highlights a common issue: controls that are assumed to be in place may not perform as expected in practice.

Why the legacy model does not scale

The legacy model of periodic assessments does not account for the dynamic nature of modern environments.

Risk is introduced through:

• Supply chain changes and new vendors





• Ongoing system reconfigurations





• Expansion of SaaS, APIs, and cloud services





• Gradual degradation of controls over time

As a result, a point-in-time certification can quickly become outdated.

Continuous readiness under CMMC

The updated CMMC guidance emphasizes continuous readiness rather than periodic validation. Self-assessments are expected to be supported by documented, day-to-day evidence of control effectiveness.

This reflects the need to maintain security posture over time, not just demonstrate it at a single point.

Continuous validation as a practical requirement

Moving to continuous validation helps organizations keep pace with:

• Changing threat activity





• Evolving supplier ecosystems





• The need to maintain confidence in control effectiveness

Without this, organizations rely on outdated assumptions about their environment and exposure.

Closing the gap between compliance and security

HORIZON3.ai’s NodeZero® Proactive Security Platform helps bridge the gap between compliance and operational security. By validating controls through real-world attack scenarios, it provides evidence of effectiveness and identifies gaps across both internal environments and critical suppliers.

This enables organizations to treat CMMC not just as a compliance requirement, but as part of an ongoing risk management program.

Final thought

True security posture is not defined by a completed assessment.

It is defined by how systems perform under real conditions, and how quickly organizations can identify and address weaknesses as they emerge. 

Learn more about how Horizon3.ai strengthens supply chain security for CMMC.
Please refer to the full white paper.