Startups trying to sell software to the Pentagon have spent years complaining about the same thing: it's not the technology that kills deals, it's the paperwork. A company can build something that works in a lab in six weeks and then wait the better part of a year for someone in uniform to say it's allowed on a military network. That gap — between what's buildable and what's deployable — is the actual chokepoint in defense tech vendor competition right now, and the Army just moved to close it.
Gatekeeper Is the Mechanism, Not CMMC
The assigned framing for this piece was the Cybersecurity Maturity Model Certification program and how its tiers are reshaping who gets to compete for Pentagon work. CMMC is real: it requires contractors to meet one of three certification levels tied to how sensitive the information they handle is, with Level 2 mapped to the 110 controls in NIST SP 800-171 and Level 3 adding requirements for the most sensitive programs (Bright Defense). As of a July 2026 industry town hall, roughly 1,866 final Level 2 certificates had been issued against an original Pentagon planning estimate of more than 337,000 prime contractors and subcontractors eventually falling in scope (Bright Defense). That gap between projected scope and actual certificates is the headline number, but it's coming from a single aggregator site citing Cyber AB town-hall figures — not the kind of primary documentation I'd want to build a whole investment thesis on.
What's better sourced, and arguably more consequential for startups trying to compete for Army software contracts right now, is something adjacent: Project Gatekeeper. The Army announced it will stand up a new AI-enhanced cybersecurity testing sandbox on Oct. 23, designed to let companies submit code for vetting even without an existing Army contract or program manager sponsoring them (Breaking Defense). Acting Army CIO Gabe Chiulli told reporters at AUSA that success looks like a company logging in, submitting code, and getting a green light "within minutes" — compared to a current process that can stall software projects for as long as nine months (Breaking Defense).
Why This Matters More Than a Certification Tier
CMMC answers the question "is this vendor allowed to handle this class of data." Gatekeeper answers a different and, for most startups, more immediate question: "can my code actually touch an Army network without a program office champion to carry it there." Chief data and analytics officer David Markowitz described the root problem plainly — there was never a single standardized process, so it fell to individual program managers, many of whom lacked the capability or appetite to run their own cybersecurity assessments and instead waited on someone else to grant Authority to Operate (Breaking Defense).
The caution behind building an AI-enhanced vetting layer rather than just fast-tracking approvals isn't unique to the Army. Elsewhere in the tech security conversation, Google DeepMind's Demis Hassabis has described AI-related hacking incidents as "early warning shots" for the broader software ecosystem (via Reuters), and AI companies themselves have reportedly been war-gaming scenarios for a catastrophic security event that could shut down critical infrastructure (via Axios). None of that is Army-specific, but it's the same underlying anxiety that shows up in Chiulli's admission that the current process involves "a lot of weird janky things" to get code into Army environments — institutions moving fast on AI-adjacent tools while genuinely worried about what they might let in (Breaking Defense). Even OpenAI's own CFO has framed vendor trust as a security variable worth weighing, arguing companies should favor Western models over cheaper alternatives on cybersecurity grounds (via Bloomberg) — a version of the same trust-architecture question the Pentagon is now trying to answer at the code level.
It also lines up with what Army Under Secretary Mike Obadal has been saying about the service's broader posture — that new Pentagon policy is explicitly aimed at stripping "antiquated red tape" out of acquisition to speed development to the field, against a backdrop of AI and unmanned systems integrating into formations faster than the bureaucracy has historically allowed (Defense News). Gatekeeper is that philosophy made concrete, with a date attached.
What to Watch
The real test comes after Oct. 23. Watch whether Gatekeeper's sandbox actually delivers approvals in minutes for a first wave of outside companies, or whether the "minutes" framing turns out to describe only the fastest possible case while most submissions still queue behind manual review. If it works as advertised, it's a more useful signal for which startups can compete for Army software dollars than any certification tier — because it changes who gets a shot at the network in the first place, not just who's allowed to touch it once they're in.
