As cyber threats grow in speed, scale, and complexity, federal agencies and the Department of Defense (DoD) are in a race to implement Zero Trust architectures. The challenge? Most traditional solutions require a costly, disruptive “rip and replace” of existing IT infrastructure.
Recently, General Dynamics Information Technology (GDIT) announced a game-changing answer to this problem with the launch of their Everest Zero Trust portfolio. Even more exciting for the future of data security is the inclusion of XQ within this groundbreaking offering.
Here is a look at what the GDIT press release means for the public sector, and how XQ’s unique value proposition acts as a force multiplier for the Everest portfolio.
The Everest Zero Trust Portfolio: A Faster Path to Security
According to GDIT’s press release, the Everest portfolio is the first proven set of Zero Trust solutions designed specifically to integrate into existing IT systems—having already successfully passed a stringent government “red team” cyber assessment.
The portfolio tackles the Zero Trust journey through three distinct solutions:
- Clarity: Delivers in-depth infrastructure assessments and actionable implementation plans.
- Flex: A modular solution that closes security gaps by integrating seamlessly into an agency’s current infrastructure and aligning with their specific roadmap.
- Unified: A full-stack solution built for new IT systems and tactical edge environments that lack legacy infrastructure.
By allowing agencies to leverage their current tech investments rather than starting from scratch, Everest removes the biggest friction points of modernization.
Why XQ is the Missing Puzzle Piece for Everest
While GDIT provides the scalable framework, architecture, and modular deployment, XQ brings an unmatched capability to the heart of Zero Trust: data-centric security.
Zero Trust is often mistakenly treated as just a network or identity problem. But the ultimate goal is protecting the data itself. Here is how XQ’s inclusion supercharges the Everest offering:
- True Data-Level Zero Trust: Instead of just building walls around the network, XQ encrypts and policy-wraps the actual data payload. Whether it’s an email, a file, or a real-time tactical chat, XQ ensures that the Zero Trust policy travels with the data. Even if data leaves the GDIT-secured network, it remains entirely unreadable to unauthorized users.
- Seamless Integration for “Flex”: GDIT’s Flex solution is all about working with what agencies already have. XQ’s lightweight, modular architecture routes encryption keys independently from the data, meaning it can be seamlessly injected into existing government workflows, legacy apps, and communications without requiring heavy new infrastructure.
- Tactical Edge Readiness for “Unified”: For the Unified full-stack deployments in operational warfighting environments, XQ offers quantum-safe encryption and granular data tracking. If connectivity drops at the tactical edge, XQ’s localized edge nodes can still verify identities and grant access to critical data, ensuring the mission continues securely.
- Unprecedented Auditability: XQ provides a real-time chain of custody for every piece of data. Agencies can see exactly who, when, and where a file was accessed—or attempted to be accessed. This gives GDIT’s customers actionable compliance and threat-monitoring dashboards right out of the box.
The Bottom Line
GDIT’s Everest portfolio is proving that federal agencies don’t have to choose between modern security and operational continuity. By incorporating XQ’s data-centric encryption and tracking into the Everest ecosystem, GDIT is delivering on the ultimate promise of Zero Trust: ensuring that no matter where data lives or travels, it remains securely in the right hands.
For the DoD and federal government, this partnership isn’t just an IT upgrade—it is a critical leap forward in national defense.
How XQ’s data-centric Zero Trust encryption works on a technical level
At the core of XQ Message’s technical architecture is a shift away from network-based perimeters. Instead of securing the pipes that data travels through, XQ makes each individual piece of data its own security boundary.
This is achieved through object-level, edge-based encryption combined with an externalized key and policy store.
Here is a technical breakdown of how the XQ data-centric encryption lifecycle works:
1. Edge-Based Encryption & Crypto-Agility
XQ does not intake or store your actual data. Instead, encryption happens entirely at the “edge”—on the user’s browser, mobile device, IoT sensor, or local server—before the data ever hits the network or cloud.
- Quantum Entropy: To generate the encryption key, the edge device requests entropy (randomness) from an XQ server. XQ streams Quantum Random Numbers (QRNG) to the edge device, which uses it to generate a highly secure, locally created encryption key.
- Crypto-Agile: The local key encrypts the data payload (an email, file, or database row) using the algorithm of choice, including Post-Quantum Cryptography (PQC) standards like NIST Dilithium.
2. Separation of Keys and Data (Externalized Key Control)
Once the data is encrypted at the edge, the encrypted payload and the encryption key are completely separated.
- The encrypted data is sent to its destination via normal storage or routing channels (e.g., AWS S3, Microsoft 365, Kafka streams).
- The encryption key is sent to XQ’s backend (the Key Cache), bundled with specific metadata and access policies (Identity, Role-Based Access Control, Attribute-Based Access Control, or Time-to-Live).
- The XQ backend generates an access token and a locator token corresponding to that key, which travel with the encrypted payload.
Because XQ never touches the actual data, and the storage provider never sees the key, a breach of either system yields nothing usable.
3. Dynamic Policy Enforcement & Geofencing
When a recipient (a user, application, or gateway) attempts to open the data, they receive the encrypted payload and the XQ tokens. To read the data, they must request the decryption key from the XQ backend by presenting the tokens along with their identity credentials.
- The XQ policy engine evaluates the request in real-time.
- Geofencing: XQ checks the IP address of the requesting entity. If the IP originates outside of an authorized geographical boundary, the key request is instantly denied.
- If all policies (identity, role, location, time) validate successfully, XQ releases the key to the authorized client, which then decrypts the data locally.
4. Continuous Audit & Data Provenance
Because every request to access a key must pass through the XQ backend, XQ creates a centralized, real-time log of every single interaction with the data—wherever it lives.
- When an interaction occurs, the identity, timestamp, geolocation, and event type are recorded.
- These HMAC-signed, SIEM-ready logs create an irrefutable chain of custody (data provenance) and serve as an automated Data Loss Prevention (DLP) monitor.
By binding the encryption key to dynamic policies and separating it from the data payload, XQ creates a “data leash” that allows organizations to revoke access, change permissions, and monitor data health long after the file has left their infrastructure.
Summary
The Problem it Solves: Most current zero trust solutions require agencies to “rip and replace” their existing IT infrastructure, which is expensive and time-consuming. Everest is uniquely designed to integrate into an agency’s current systems.
The Three Offerings:
- Clarity: Assesses existing IT infrastructure and builds an actionable roadmap for zero trust implementation.
- Flex: A modular solution that plugs zero trust gaps within an agency’s existing infrastructure, accelerating deployment.
- Unified: A full-stack zero trust solution built for new IT systems or operational warfighting environments at the tactical edge.
Proven Validation: The Everest portfolio is the first of its kind to successfully pass a rigorous federal government “red team” cyber assessment.