Software vendors that want to sell to the Army will soon be able to test their code against the service's cybersecurity checks before they hold a contract, find a sponsor or answer a solicitation. The Army will open Project Gatekeeper, an AI-assisted sandbox for vetting commercial code, on Oct. 23, officials said Tuesday. The goal, according to officials, is for companies to get their code assessed and accredited "in a matter of minutes instead of months."
Acting Army Chief Information Officer Gabe Chiulli heads the effort. He and other officials described it at the annual AUSA conference in Washington as a way to replace an inconsistent, program-by-program approval process with a single, standardized front door for commercial software, without lowering the security bar.
How Project Gatekeeper Vets Vendor Code
Gatekeeper is a single sandboxed environment that runs on the Army's cloud but sits isolated from operational networks and sensitive data, Breaking Defense reported. Once a company gets access, it uploads its software and runs it through the Army's standardized cybersecurity tools, including an AI assessment. Within minutes, the automated system either tells the company the software passed or returns detailed, actionable feedback explaining why it failed.
The platform will also include the Army's DevSecOps software development kit, according to David Wright of the Army Software and Innovation Center (ASIC), giving companies a secure place to fix problems using tools the Army itself has vetted.
Chiulli described the end state in concrete terms. "Success to me looks like a company, within minutes, is able to log in, commit their code, get the green check mark from our pipeline that says you are good to go, and they’re very quickly able to provide that code up the network to wherever they may be able to deliver," he said.
The sequencing matters as much as the speed. Under Gatekeeper, companies can submit code for AI scanning before they're on contract, before a program manager sponsors them, and before they respond to a request for information or a request for proposals. If a program manager later takes on the software through an acquisition pathway, officials said, it arrives already vetted.
Why Software Approvals Stalled for Up to Nine Months
Officials said moving code from industry environments into the Army's can take days, weeks or months for some larger programs. Breaking Defense reported that the process has stalled some software projects for as long as nine months. Chiulli called it a "mechanically painful process to deal with" for vendors.
The root problem, officials said, is that the Army has lacked a single, centralized process for bringing commercial software onto its secure networks. Instead, "it was up to every program manager," said David Markowitz, the Army's chief data and analytics officer.
Many program offices lacked the capability or willingness to assess unfamiliar code on their own, so they waited for another organization to vet the company and grant its software an Authority to Operate (ATO). That made the ATO a gate in its own right. "A lot of times, organizations in the Army won’t talk to [companies] until they have this ‘golden ATO,’" Chiulli said.
The result, as Breaking Defense described it, was a Catch-22 that favored companies already holding Army software work, while newer entrants struggled with the combined weight of cybersecurity rules, procurement regulations and Army bureaucracy.
Testing was its own hurdle. Program managers rarely had a dedicated, isolated sandbox, so they brought new software onto an Army network to assess it there. That required vendor personnel to obtain Common Access Cards (CAC). "We spent a lot of time and energy trying to get people CAC cards simply to help work with us," Chiulli said.
Does Faster Mean Looser Security?
Officials insisted it does not. Chiulli framed Gatekeeper partly as a security fix: the old ad hoc arrangements left the Army with less visibility into what was reaching its networks. "We have had to do a lot of weird janky things to get code into our environments," he said.
He described the choice as one between building a monitored channel for industry code or tolerating the status quo. Under the first option, the Army can "check it very actively before it even gets pushed into our environments," he said, rather than face the alternative, "which is I’m not sure how they’re getting the code over to us."
Wright made the same point about standards. "The idea here is not to lessen the security requirements, but more to make the process more accessible and available, so that they can get immediate feedback and understand what it is that needs to be adjusted or corrected before these things are brought into an Army environment," he said.
The timing reflects pressure on both sides of the equation. DefenseScoop noted that AI has increased the speed and scale at which malicious actors can exploit network vulnerabilities, even as the Army tries to lower barriers for companies that want to work with it.
CAC Cards First, Login.gov by Mid-November
Gatekeeper will not be fully open to the commercial market on day one. Companies will still need CAC cards to access the platform initially, officials acknowledged. The Army is working with the General Services Administration to integrate Login.gov, which lets members of the public securely access government systems.
"We’re looking at mid-November to have that integrated, at which point we’ll be able to make this actually commercially accessible," Wright said.
Until that integration lands, the practical audience for Gatekeeper is vendors whose personnel already have CAC access. The broader opening to new entrants depends on the GSA integration staying on its mid-November schedule.
What It Means for Contractors
For software companies pursuing Army business, Gatekeeper changes the order of operations. Instead of waiting for a program office to sponsor an ATO, a vendor can run its code through the Army's own security pipeline early, see exactly what fails, and fix it before a capture effort reaches the proposal stage. Code that passes arrives at any later acquisition already vetted, which could remove one of the reasons program offices hesitated to engage with unfamiliar vendors.
Several practical points follow from what officials described:
- Prepare for CAC-only access at launch. Firms without CAC holders should plan around the mid-November Login.gov integration rather than the Oct. 23 start date.
- Treat the feedback as a pre-submission audit. Because the system returns specific reasons for failure, vendors can use it to close gaps before responding to an RFI or RFP.
- Expect the same bar, applied sooner. Officials were explicit that security requirements are not being reduced; the change is in access and timing.
- Use the Army's DevSecOps kit. Remediating with tools the Army has already vetted may shorten the path to a passing result.
Smaller and newer software firms stand to gain the most if the program works as described, since the "golden ATO" dynamic, as Breaking Defense described it, favored companies that already had Army software contracts.
