The Army promises a green check in minutes

The US Army plans to open Project Gatekeeper on Friday, 23 October, a platform where companies can submit software for automated security vetting before it reaches Army networks. Gabe Chiulli, the acting Army chief information officer, gave the date on Tuesday last week at the Association of the US Army's annual meeting in Washington, as reported by Breaking Defense, DefenseScoop, Federal News Network and GovCIO Media. We found no further Army statement on the launch by Sunday.

The platform is walled off from the networks it feeds. Breaking Defense described a sandbox running on the Army's cloud but isolated from operational networks and sensitive data. David Wright, chief architect at the Army Software and Innovation Center, told Federal News Network that it is built on the Defense Department's network "with the same controls that you would find in an [Impact Level 5] environment, it's just separated, being made commercially accessible".

Companies will not need an Army contract, a programme manager to sponsor them or a request for proposals to respond to, Breaking Defense reported. Their code runs through the Army's standard cybersecurity tools, including an AI assessment, and comes back either passed or with detailed feedback on why it failed. GovCIO Media reported that the AI-enabled check is the last step in the accreditation process. Gatekeeper also carries the Army's DevSecOps software development kit.

"Success, to me, looks like a company, within minutes, is able to log in, submit their code and get the green check mark from our pipeline that says you are good to go," Chiulli said, as Breaking Defense quoted him. Today, he said, "A lot of times, organizations in the Army won't talk to [companies] until they have this 'golden ATO'," meaning an Authority to Operate on military networks. Chiulli and other officials said clearance can take days or weeks and has stalled some software projects for as long as nine months.

Part of the problem was that nobody owned the process. Before Gatekeeper, "it was up to every program manager", said David Markowitz, the Army's chief data and analytics officer. "We have had to do a lot of weird janky things to get code into our environments," Chiulli said.

The "minutes" claim comes with a condition. "It depends upon our industry partner to actually meet the higher security standards," Markowitz told GovCIO Media. "Some folks may find it a challenge to meet those higher security standards, and they rightfully may take a long time to get an ATO because they're not secure. But now, they get the feedback instantly, so if you're ready and you're secure, it can be minutes." Wright made the same point to Breaking Defense: "The idea here is not to lessen the security requirements."

Access will be narrow at first. Companies will need Common Access Cards to log in at launch, Breaking Defense, Federal News Network and GovCIO Media reported, until the General Services Administration's Login.gov service is connected. "We're looking at mid-November to have that integrated, at which point we'll be able to make this actually commercially accessible," Wright said. Chiulli described the cost of the current arrangement: "We spent a lot of time and energy trying to get people CAC cards simply to help work with us."

On AI, the Army's own engineers sound measured. Wright told GovCIO Media that the service is working with frontier AI companies on new ways to detect vulnerabilities, but that "traditional tools, from the security perspective, are still incredibly effective at finding malicious activity inside the codebase". He said cryptographic attestations ensure the software moved onto Army networks is "one-for-one the software that we have evaluated". None of the outlets named a vendor, a model, a budget or the threshold for a pass.

For software sellers, the change is who gets through the door. A route that needs no sponsor opens the Army to companies that have never sold to it, the same shift in buyer requirements we described in our report on software supply-chain rules and in our analysis of procurement-led AI rules. The tests come next: whether the Army publishes how many submissions pass and fail after Friday, and whether Login.gov access arrives in mid-November as planned.