World Wide Technology secured a $40 million contract to build and operate an artificial intelligence-enhanced Security Operations Center for Air Combat Command, according to an Air Force contract announcement published this week. The award positions WWT — a St. Louis-based technology solution provider with deep federal defense relationships — as a key integrator for one of the most operationally demanding cyber environments in the U.S. military. Air Combat Command's network spans fighter wings, bomber units, tanker fleets, intelligence and surveillance aircraft, and the command and control infrastructure that ties those assets together across dozens of installations worldwide, creating a threat surface that no conventional analyst-driven SOC can adequately defend at scale.
Under the contract, WWT will integrate machine learning-based threat detection platforms with ACC's existing Security Information and Event Management infrastructure, building automated playbooks that allow the SOC to triage and respond to lower-severity incidents without human intervention. This automation frees analysts to focus their expertise on the sophisticated, low-and-slow adversary activity that represents the most serious threat to the command's operational networks. The contract includes a base period and multiple option years, with the full five-year potential value reaching the announced $40 million ceiling, and performance metrics tied to detection rates, mean time to respond, and system availability rather than the input-based staffing metrics that have characterized older cyber service contracts.
The award reflects a structural shift in how the Defense Department evaluates and procures cybersecurity services. Rather than contracting for a specified number of analysts at defined labor categories — the body-shop model that dominated DoD cyber contracting for much of the past two decades — the ACC contract is outcome-based. WWT is accountable for what the SOC produces, not merely for putting qualified personnel in seats. This shift changes the risk calculus for both the government and the prime contractor, incentivizing investment in automation and tooling that multiplies analyst effectiveness rather than simply adding staff headcount to address growing threat volumes.
Defense officials noted that the AI SOC contract aligns with the Air Force's Cyber Resilience framework, which emphasizes the ability to continue mission-essential operations even while under active cyberattack. This concept requires the SOC to act not just as a detection and response center but as an active participant in operational risk management, giving ACC leadership real-time visibility into the command's cyber posture and enabling commanders to make informed decisions about which operations can proceed during a contested cyber environment.
Contract Scope and Background
Air Combat Command's cybersecurity requirements sit at the intersection of operational technology and information technology — a particularly challenging environment for any SOC operator. Aircraft maintenance systems, mission planning tools, and command and control networks each carry different classification levels and different risk tolerances, meaning that the AI models powering the new SOC must be trained and validated against ACC-specific data rather than generic commercial threat intelligence. WWT's scope includes that model development and ongoing retraining work, a continuous process because adversary tactics, techniques, and procedures evolve faster than any static detection ruleset can track. The contract also covers threat hunting operations where human analysts proactively search for adversary presence in segments of the network that automated detection has not flagged, a discipline that requires both advanced tooling and highly skilled practitioners working in concert.
The technology stack underlying the ACC AI SOC draws on commercial platforms that WWT has deployed extensively in enterprise and federal environments. While the specific products selected are not specified in publicly available contract documents, WWT has longstanding relationships with security technology manufacturers including Cisco, Palo Alto Networks, and Splunk, whose platforms provide the data collection, normalization, and analysis infrastructure on which AI-based detection models run. Integrating those commercial platforms with the Air Force's existing network architecture, classification requirements, and Authority to Operate framework is itself a substantial engineering undertaking that represents a significant portion of the contract value.
The subcontracting structure for the award has not been publicly disclosed in detail, but engagements of this type typically involve a constellation of specialty firms providing niche capabilities in areas such as threat intelligence feeds, malware analysis, red team adversary emulation, and security engineering. WWT's scale as a technology integrator gives it the supply chain relationships to assemble these capabilities without maintaining all of them in-house, a flexibility that benefits both the program and the small business ecosystem that supplies specialized cyber services.
What It Means for Contractors
For companies interested in the military cyber services market, the WWT award at ACC signals the direction of future procurement across other major commands. Air Mobility Command, Air Force Materiel Command, and Air Force Space Command have all expressed interest in SOC modernization in recent budget justification documents, and the ACC contract will serve as a proof of concept that shapes how those future solicitations are structured. Companies that want to compete for similar work should invest now in demonstrating measurable SOC performance metrics and in building the AI and machine learning capabilities that agencies will require — not just the staffing credentials that dominated previous-generation cyber RFPs. Firms that can show documented detection rate improvements, reduced mean-time-to-respond statistics from comparable engagements, and validated AI model performance in operational environments will have a genuine competitive advantage over firms relying solely on clearance counts and resume depth.
For small businesses, the AI SOC market presents concentrated opportunity in the subcontract tier. The large system integrators that hold prime positions on these contracts actively seek niche capability providers for threat intelligence, model validation, red team operations, security engineering, and compliance management. Cybersecurity firms holding DoD 8570 Information Assurance Technical certifications at Level II or III, those with specialized AI and machine learning expertise validated through programs like NSA's Commercial Solutions for Classified, and firms with demonstrated experience in zero-trust network architecture are well positioned to fill these subcontract roles. Watching SAM.gov for subcontracting plan postings from WWT and similar primes on new cyber awards, and proactively registering in their supplier portals before solicitations are issued, is the most direct path to subcontract opportunities on programs like the ACC AI SOC.
