The U.S. Army just handed a Huntsville, Alabama, small business up to eight years and $400 million to go hunting for holes in how American forces defend against electronic and cyber attack. On Sept. 22, 2026, the Department of War's daily contract announcement named Trideum Corp. as the winner of a firm-fixed-price indefinite-delivery/indefinite-quantity contract "to find gaps and vulnerabilities in areas of cyber electromagnetic activities."
The award, contract number W911S0-26-D-A011, was solicited with a single bid and a single bid received. The U.S. Army Field Directorate Office at Fort Eustis, Virginia, is the contracting activity, and the estimated completion date is Sept. 21, 2034 — an eight-year ordering window during which the Army can issue task orders against the ceiling without running a new competition each time. Work locations and specific funding amounts will be determined with each individual task order, so the $400 million is a maximum, not a guaranteed obligation.
The Trideum award was one of ten contracts the Department of War announced that day — and, at $400 million, the largest dollar figure among them. "The Department of War announced ten contract awards, including a $400 million cyber electromagnetic activities contract for Trideum Corp.," Washington Policy Review reported in its Sept. 22 roundup.
What "Cyber Electromagnetic Activities" Actually Covers
Cyber electromagnetic activities, or CEMA, is Army doctrine's umbrella term for the fight that happens across networks and the electromagnetic spectrum at once — offensive and defensive cyberspace operations layered on top of electronic warfare and spectrum management. A unit that can be jammed, geolocated by its own radio emissions, or hacked through a networked sensor is vulnerable in CEMA terms even if no rifle round is fired. The contract language is narrow but consequential: find the gaps and vulnerabilities in that space before an adversary does. That puts Trideum in the position of red-teaming the Army's own cyber and electromagnetic posture rather than building a system, a role closer to a standing penetration-testing shop than to a traditional systems-integration contract.
A Small Business Already Embedded in Army Cyber Testing
Trideum is not a new name to Army test-and-evaluation work. The company, founded in 2005 and listed on the Inc. 5000, already holds a separate, earlier contract awarded through the Consortium for Command, Control, and Communications in Cyberspace (C5) Other Transaction Authority: the Cybersecurity Vulnerability Assessment Test Environment, or CVATE, a single-award deal with a $37.2 million ceiling over four years. Under that contract, Trideum is prototyping a cyber test environment that is part of a broader test capability being established at the Army Test and Evaluation Command's Redstone Test Center in Alabama — cyber test infrastructure for the Army's evaluators rather than assessing CEMA gaps directly — putting the company inside the Army's cyber-test ecosystem well before the Sept. 22 award. Trideum's chief technology officer, Kurt Lessmann, described the company's approach to that earlier work in a statement announcing CVATE: "Trideum is proud to support the Army Test and Evaluation community under the CVATE contract. As we begin to prototype the cyber test environment, we look forward to putting the best creative talents to work to deliver a strong cybersecurity test capability for the Army."
The two contracts are distinct — different contracting activities, different scopes, four years apart in scale of commitment — but together they show a small business building a track record as an Army cyber-test vendor in north Alabama, a region already dense with Army aviation, missile and test-and-evaluation commands. Winning a $400 million IDIQ against that backdrop reads less like an entry into a new market and more like an expansion of work the company was already positioned for.
One Bid, Eight Years, and a Ceiling Instead of a Check
The "one bid solicited, one received" line in the Department of War's announcement is standard contracting-office language, but it is worth pausing on. It means the Army did not run a competition among rival vendors for this specific award; it solicited from a pool and Trideum was the only company that responded, or the solicitation was structured so that only Trideum was eligible to bid. Either way, the number that will make headlines — $400 million — is a not-to-exceed ceiling spread across an eight-year ordering period, not a lump sum landing in Trideum's account. Under an IDIQ, the Army buys individual task orders against that ceiling as needs arise; a slow year of CEMA assessment work could mean a fraction of the ceiling gets spent, while a year of heavy tasking could push obligations sharply higher. The completion date of Sept. 21, 2034 marks when the ordering window closes, not when the money runs out.
What It Means for Contractors
For small businesses working the Army test-and-evaluation and cyber-assessment space, the Trideum award is a data point worth studying rather than envying from a distance. An eight-year IDIQ built around finding weaknesses in cyber electromagnetic activities signals that the Army wants a standing, on-call capability for this kind of assessment rather than a one-time study — the kind of recurring-demand structure that rewards a vendor already embedded in the customer's test infrastructure, as Trideum was through its CVATE work supporting the Army Test and Evaluation Command's Redstone Test Center. Companies chasing similar work should note that the solicitation here drew a single bid; a large, multiyear ceiling contract with CEMA-testing scope may not attract broad competition, which can mean less unclaimed opportunity for newcomers but also less crowded turf for a firm that can show relevant Army cyber-test experience already. The contracting activity, Fort Eustis' Army Field Directorate Office, and the underlying CEMA mission area are worth tracking for related solicitations, since task orders under this ceiling — and any follow-on requirements the Army identifies through Trideum's assessments — are likely to surface over the next several years rather than all at once.
