Cybersecurity

More than 150 U.S. cities have reportedly banned, rejected, or deactivated Flock Safety’s AI-enabled license-plate reader cameras amid concerns about misuse, data sharing, and privacy. The trend signals heightened scrutiny for public-sector surveillance procurements, particularly around access controls, auditability, transparent policies, and legal review.

Git’s November 10 advisory warns that CVE-2026-111760 could enable remote code execution during recursive cloning of attacker-controlled repositories. With all versions listed as affected and no patch available as of November 15, agencies and contractors should review development and CI workflows, pause untrusted recursive clones, and monitor Git’s advisory.

Arch Systems and Knox Systems made Arch’s factory data platform and AI applications available to qualified defense and regulated manufacturers inside Knox’s FedRAMP High (Class D) environment, with single-tenant and customer private-cloud deployment options. The offering creates a platform option for CUI-related factory workloads, but buyers must assess shared security responsibilities and AI-agent authorization; no contract vehicle, pricing, solicitation, or award was disclosed.

Australia plans to legislate safety and security requirements for frontier AI companies, overseen by a dedicated regulator working with the Australian AI Safety Institute. The proposed rules could shape compliance expectations for AI vendors and government contractors, but bill text, penalties, implementation dates, and procedures remain unpublished; no procurement opportunity has been announced.

The Department of the Navy will convene an industry-facing quantum conference on November 17, 2026, covering computing, sensing, networking, cybersecurity, and modernization. The event offers market insight into Navy information-warfare priorities, but no solicitation, award, or specific procurement opportunity is identified.

The State Department’s Office of Security Technology is recruiting cybersecurity and computer science professionals through universities, laboratories, the military, and industry. Paid internships and overseas experience offer talent-development pathways, while difficult overseas postings and a broad threat environment underscore workforce challenges across more than 450 facilities; no procurement or award was announced.

Experts warned that Iranian-affiliated actors may target U.S. water, energy, government, healthcare, and business systems. Microsoft attributed its November 12 Microsoft 365 outage to infrastructure and server problems, not a confirmed cyberattack; the warning points to resilience priorities but identifies no new procurement, funding, or award.

The United States has joined U.K.- and France-led voluntary guidelines for commercial cyber intrusion capabilities, including spyware. The framework promotes compliance, due diligence, risk management, and monitoring, but creates no binding procurement terms or immediate funding opportunity; agencies and contractors should prepare for greater scrutiny of suppliers, access controls, and supply chains.

Federal agencies are tightening controls for AI procurements, with GSA safeguards covering data handling, supplier due diligence, foreign influence, human oversight, and incident reporting. DoD guidance emphasizes vendor transparency and enforcement, including a 15-business-day response window; the roundup identifies no specific solicitation or award.

The FBI and Department of Justice seized infrastructure tied to a North Korean-linked campaign that used fake video meetings and compromised accounts to steal more than $400 million in cryptocurrency and target software developers. Separately, courts authorized seizure or restraint of more than $1.2 billion stolen from Binance, part of the more than $2.7 billion frozen through public- and private-sector efforts; no procurement opportunity or award was announced.

A 2026 research review proposes combining Zero Trust Architecture with agentic AI to automate cybersecurity functions across distributed cloud environments. The concept is a technology-market signal, not a procurement action; buyers should assess explainability, reliability, response latency, and human oversight.

Haverhill, Massachusetts, is seeking to cancel its existing Flock Safety license plate reader contract while the City Council develops an ordinance governing surveillance technology. The proposed rules could require public input before future contracts and establish new use and data-safeguard requirements, creating uncertainty for suppliers pursuing city work.

The Federal Reserve’s semiannual Financial Stability Report flags AI-fueled enthusiasm and elevated U.S. equity valuations, higher long-term interest rates, and fiscal debt sustainability concerns as vulnerabilities. It also warns that AI may lower the cost and expertise required for sophisticated cyberattacks, offering contractors risk intelligence rather than a procurement opportunity.

Breaking Defense is offering a free eBook compiling coverage of AFCEA’s TechNet Indo-Pacific 2026, with themes including resilient military networks, cyber defense, electronic warfare, and multinational information sharing. The material is informational rather than a procurement opportunity, but it can help contractors assess regional defense priorities, including those related to Taiwan.

Space Systems Command seeks white papers by November 23, 2026, from U.S.-owned companies interested in associate membership in the Space Data Network Consortium. The no-dollar-value OTA notice is market research—not an RFP or a promise of follow-on work—and requires relevant technical capabilities, active SAM.gov registration, and systems meeting CUI protection requirements.

Johnson Controls, Inc. and two subsidiaries agreed to pay $5 million to resolve False Claims Act allegations over cybersecurity requirements on contracts supporting NASA, DoD, DOE, and DOJ. The alleged failures spanned January 2018 through August 2025, highlighting the importance of contract-specific security controls and records documenting remediation.

Following an appellate-court data breach, Ohio House Technology and Innovation Committee Vice Chair Heidi Workman urged lawmakers to prioritize cybersecurity during the lame-duck session. The call signals policy attention for court security, but no funding, solicitation, vendor, implementation timeline, or specific procurement action has been identified.

AI-enabled penetration testing can increase the frequency of technical checks, but it does not replace independent review of CUI boundaries, control implementation, governance, or incident response. Defense contractors should continue aligning with DFARS 252.204-7012 and NIST SP 800-171, maintain accurate CUI and system inventories, and treat the cited testing-cost comparison as illustrative.

Optikos, LLC announced it earned CMMC Level 2 certification after an independent assessment, confirming its cybersecurity controls meet DoD requirements for protecting Controlled Unclassified Information. The credential may strengthen its eligibility for CMMC-covered work, but the announcement names no specific solicitation or contract; about 2,300 of more than 200,000 defense suppliers had achieved Level 2 certification by September 2026.

Reports alleging a foreign-intelligence connection involving Nvidia CEO Jensen Huang have prompted an independent board investigation and renewed questions about federal counterintelligence support for technology companies. No affected contract, new solicitation, or award has been identified; the development is primarily relevant to contractor security practices, supplier-risk review, and Nvidia’s government-relations exposure.

More than 550 FedRAMP-certified cloud providers must adopt risk- and exposure-based vulnerability detection and reporting by December 7, 2026, with a March 7, 2027 compliance milestone for providers using corrective action plans. Federal buyers should monitor provider authorization and remediation status as the rule may affect supplier eligibility and drive demand for cybersecurity tools and implementation support.

A White House AI task force urged regulators to consider at least 12 months of liability flexibility for organizations that voluntarily report cyber incidents in good faith, citing AI-driven threats and potentially outdated standards. The recommendation is not binding policy or a procurement announcement; contractors should track it separately from CISA’s forthcoming incident-reporting rule.

The FBI describes using AI and digital automation to reduce administrative workload while reorganizing cyber operations to better support its mission. The priorities may inform future demand for enterprise AI, workflow automation, data analysis and cybersecurity, but the announcement identifies no solicitation, award, funding or procurement timeline.

The State Department will pilot online submission of Form DS-11 from November 16, 2026, through November 20, 2027, using America.gov and Login.gov. The effort signals demand for secure digital application and identity-verification services, but no solicitation, award, funding, or vendor action is identified.

VulnCheck disclosed 14 vulnerabilities in Copeland/Dixell XWEB EVO refrigeration supervision systems; lab testing found each could enable root or administrative access, and at least two are reportedly being actively exploited. Government facility operators and contractors should identify exposed and legacy systems, remove them from the public internet, and apply available patches.

The Department of Veterans Affairs launched a redesigned VA.gov on November 11, 2026, adding natural-language search, CLEAR and passkey sign-in, and streamlined claims and document workflows. The modernization may signal demand for digital-service, identity, accessibility and cybersecurity capabilities, but no solicitation, award, contract value or acquisition timeline was identified.

ILC Dover LP and ILC Astrospace LLC agreed to pay $13 million to resolve allegations that cybersecurity controls were inadequate on federal contracts supporting the Army, Missile Defense Agency, and NASA. The settlement, including $6.5 million in restitution, highlights False Claims Act and financial exposure tied to inaccurate security assessments and third-party cloud oversight, even without a successful breach.

Patrick Newbold will leave CMS on November 27, with Information Systems Group Director Mark Plaugher serving as acting CIO while the agency searches for a permanent successor. Contractors should plan for leadership continuity and connect technology proposals to measurable outcomes across modernization, cybersecurity, cloud services, and responsible AI—without assuming a change in requirements or a new procurement.

inDirectIT appointed retired Air Force veteran and former CMMC Level 2 lead assessor Alexy Johnson as Director of Compliance Services. The hire reflects continued contractor demand for CMMC readiness and NIST-aligned support, even as the Pentagon’s planned second phase is suspended and applicable self-assessment and CUI protection obligations remain in effect.

NIST SP 800-88 Rev. 2 warns that degaussing can disable a drive without sanitizing its data, particularly on newer, higher-coercivity magnetic media. Federal buyers and contractors should assess media compatibility, applicable NSA/CSS evaluation status, and Trade Agreements Act eligibility—and distinguish sanitization from physical destruction.

Congress faces a December 11, 2026 deadline to renew three cybersecurity and modernization authorities as lawmakers also consider AI-safety proposals and debate whether to reauthorize lapsed FISA Section 702 through the NDAA. The outcome could affect federal cyber services, agency modernization and intelligence-related priorities, but no specific procurement or award is identified.

Redspin says it has earned ISO/IEC 17020:2012 accreditation, becoming one of the first accredited CMMC Third Party Assessment Organizations (C3PAOs). For Defense Industrial Base contractors pursuing CMMC Level 2, the milestone adds an independently evaluated assessment option but does not create a contract opportunity or change compliance deadlines.

Parsons says it is moving its Federal Solutions business toward higher-margin hardware and software while reducing lower-margin services. Its 26 OTAs, $1.6 billion OTA award baseline, and largely funded backlog highlight potential activity across defense technology, but the source names no specific agencies, solicitations, or production-transition dates.

A Federal News Network commentary argues that coalition interoperability depends on consistent data classification and governance as well as technology. Defense and intelligence procurement teams can consider data-sharing rules and data-level policy enforcement when planning AI, cloud, zero-trust, and analytics acquisitions; no solicitation or new mandatory requirement is identified.

A Washington Technology podcast explores how rapid advances from frontier AI labs are changing cybersecurity tradecraft, cyber-defense budgeting, and government-industry partnerships. The discussion offers strategic context for federal contractors, but identifies no solicitation, award, funding amount, procurement timeline, or point of contact.

CISA’s Binding Operational Directive 26-04 requires covered civilian agencies to prioritize software vulnerability remediation by risk, with the highest-risk tier due within three days. Contractors are not directly covered, but agencies may impose similar timelines and evidence requirements through contracts and security programs, increasing the importance of continuous exposure tracking and auditable records.

GSA’s Federal Acquisition Service is seeking information on commercial products and services that could help agencies migrate to post-quantum cryptography. Responses are due December 7, 2026; the RFI is market research only and does not promise funded work or a follow-on solicitation.

The House passed seven bipartisan small-business bills on November 11, including measures on veteran-owned businesses, cybersecurity and CMMC information, and domestic manufacturing connections. Senate action is still required; the bills create no immediate contract opportunities or funding, and the cybersecurity proposal expands outreach rather than imposing new CMMC requirements.

Broadcom security executive Manoj Sharma recommends continuously correlating identity and endpoint activity, including AI-agent behavior, to strengthen zero-trust visibility across cloud, on-premises, and remote environments. The signal points to potential contractor demand for integrated capabilities but identifies no solicitation or contract award.

Army CID issued an RFI for commercial, cloud-hosted software to identify and investigate threats across darknet sites, encrypted messaging services, and alternative social platforms. The market research highlights demand for AI-enabled analysis, cross-platform identity correlation, evidence preservation, and protected undercover workspaces; it is not a solicitation or award, and responses are due December 9, 2026.

The **U.S. Navy** is soliciting small-business proposals for a potential **$99 million multiple-award IDIQ** supporting Flank Speed cloud and network operations. Proposals are due **December 11, 2026**; bidders should assess the active top secret facility-clearance requirement, specialized staffing needs, and capacity to operate in a three-to-six-award environment.

Researchers report that Kazakhstan-linked group Silent Lynx used an autonomous AI framework to breach Tajikistan’s electronic document system and steal more than 2,000 national security-related documents. The incident underscores procurement and operational priorities for agencies and contractors managing sensitive document platforms, including access controls, activity monitoring, and safeguards against automated data extraction.

TYCHON argues that cryptographic discovery must lead to traceable remediation, connecting findings to asset owners, business risk, dependencies, authorized changes, and verification. The sponsored article highlights potential requirements for federal cryptographic inventory and post-quantum readiness efforts, but identifies no solicitation, award, funding, or procurement timeline.

The VA’s November 11 VA.gov refresh adds AI-enabled search, document submission and tracking, and sign-in options including passkeys, magic links, and CLEAR. A separate CLEAR1 pilot at six VA medical centers points to potential demand for identity verification and digital-service capabilities, but no contract award, active solicitation, value, or expansion timeline has been announced.

Richmond Public Schools says personal information of current and former students, employees, and contractors was posted on the dark web after a cyberattack. The district is restoring systems, conducting a forensic audit with federal officials, resetting passwords, and expanding identity monitoring; no procurement opportunity or contract timeline has been announced.

A cybersecurity discussion raised concerns about whether MITRE Caldera meets current adversary-emulation needs and asked about lower-cost alternatives, but named no competing products or prices. Government security teams and contractors may use the discussion to review capability gaps, costs, and supplemental methods; it does not indicate a defined procurement opportunity.

A reported upload of volunteer PII to a consumer chatbot underscores a broader data-egress risk and growing demand for approved enterprise AI, DLP, and secure-access controls. Procurement teams should assess retention, input-training, identity, and integration requirements while organizations review provider terms and consult privacy staff after an exposure.

A cybersecurity commentary warns that AI-related attacks could exploit trusted identities in county and campus systems. For government contractors, the concern points to demand for stronger identity controls, monitoring, and incident response across state and local environments, though the source provides no specific procurement, funding, or agency details.

Red Hat’s RHEL 10.3 release adds sealed images for Image Mode, post-quantum cryptography features aligned with CNSA 2.0 requirements, and self-managed AI assistance for disconnected environments. This is a product update, not a procurement award or solicitation, but it may inform federal technology evaluations, security reviews, and deployment planning.

NIST released a practical cybersecurity guide for businesses without paid employees and firms with limited IT resources, organizing risk-management practices around the six functions of its Cybersecurity Framework. The guide creates no new procurement requirement, but small contractors can use it to review security readiness when handling sensitive information.