Federal IT

An outlook warns that AI-enabled cyber threats, financial stress tied to AI investment, geopolitical disruption, and policy uncertainty could combine into broader market and policy shocks through 2028. For federal buyers and contractors, the practical takeaway is to prioritize vulnerability patching and cyber resilience; the article identifies no solicitation, award, funding allocation, or compliance deadline.

On October 25, 2026, NSA, CISA and NIST released 10 practices for preparing for, detecting, responding to and recovering from security incidents involving super-intelligence systems during training and evaluation. The guidance signals federal attention to AI security but announces no solicitation, award, funding or mandatory requirement.

The NSA, CISA and FBI urged organizations to patch two critical PHP remote-code-execution flaws after emergency fixes were released on October 21. Reported exploitation attempts reached millions, but successful compromises and widespread exploitation remain unconfirmed; agencies and contractors should inventory underlying PHP runtimes and isolate systems that cannot be patched promptly.

Carahsoft is expanding public-sector access to Hyperproof’s governance, risk and compliance automation and Nothreat’s threat-detection tools through its reseller network and established purchasing vehicles. The announcement creates additional routes to market, including NASA SEWP V and NASPO ValuePoint, but identifies no new award, solicitation, or contract value.

NIST is developing five volumes of Control Overlays for Super Intelligence Systems (COSIS), adapting SP 800-53 controls to predictive, generative and agentic AI. The planned guidance could inform federal AI security requirements and contractor assessments, but it is still in development and is not described as a new mandatory requirement.

CISA branch chief Lindsey Cerkovnik is leaving after nearly six years, creating a leadership transition across vulnerability response, industrial-control-system vulnerabilities, and the CVE Program. A 2025 contract extension prevented a potential CVE data-flow interruption, but no new solicitation, contractor, contract value, or replacement official has been identified.

The Department of Homeland Security forecasts a 12-month, departmentwide follow-on BPA for identity, credential and access management support, valued at $50 million to $100 million. The forecast identifies a sole-source acquisition with no specified small-business set-aside; DHS targets a November 20, 2026 solicitation and expects an award in the first quarter of FY2027.

NIH, the State Department, and the Library of Congress are moving beyond isolated AI pilots toward workflow-driven applications supported by governance, workforce training, and measurable outcomes. For contractors, the shift favors secure, adaptable solutions paired with data integration, implementation, and ongoing enablement services.

MeriTalk and sponsor Okta are promoting an educational ebook on public-sector identity security, covering threats including session hijacking, lateral movement, unmanaged machine identities, and shadow AI. The resource is not a solicitation or award, but it offers procurement teams and contractors a checklist of issues relevant to zero trust, identity and access management, and cyber resilience.

Accenture Federal Services and Google Public Sector announced Gemini Launchpads to help federal agencies build and operationalize mission-focused AI agents using Gemini and secure cloud infrastructure. The capability includes embedded engineering, integration, training, workshops, and agents for administrative workflows, but no customer, contract, funding, or procurement timeline was disclosed.

The Department of Homeland Security has directed federal civilian agencies to remove DeepSeek products and services built with DeepSeek technology, and to prohibit future purchases, subject to possible exceptions. The move raises compliance and enforcement challenges because derivative models can obscure their origins, increasing the importance of model-provenance documentation and agency network monitoring.

Google DeepMind employees have resigned or are considering leaving over the company’s U.S. Department of Defense AI agreement and Project Nimbus with the Israeli government. The dispute underscores how AI-use restrictions, government decision authority, workforce concerns, and reputational risk can affect contract design and delivery.

Federal agencies are scheduled to transition key systems to post-quantum cryptography in stages from December 2030 through 2035, while contractors must meet stated NIST cryptographic standards by December 2030. AI-generated mathematical results have heightened concern about encryption resilience, making cryptographic inventories, implementation reviews, and crypto-agility planning immediate compliance priorities.

Federal cybersecurity is shifting from periodic certification and manual GRC reviews to ongoing security operations built around automated controls, continuous monitoring, vulnerability remediation and current evidence. The change, reinforced by FedRAMP 20x and continuous authorization, signals sustained service and customer-coordination needs for contractors, but the sources identify no active solicitation, award or contract value.

DHS issued a FASCSA exclusion and removal order requiring roughly 430 federal civilian agencies to stop buying DeepSeek products and remove covered products from agency IT systems. The order also reaches third-party offerings developed using DeepSeek implementations, making supply-chain provenance a procurement and compliance concern; no government-wide removal deadline has been set.

DHS has directed federal civilian agencies to remove DeepSeek technology from IT systems and barred purchases of DeepSeek products and third-party offerings built with its technology. The restriction took effect at the end of July, excludes the Department of Defense, and makes AI provenance and supply-chain visibility immediate compliance concerns for federal contractors.

Maximus agreed to acquire Agile Defense for $660 million in cash, with additional contingent consideration tied to performance objectives. The acquisition would add roughly 1,800 employees and deepen Maximus’ cybersecurity, AI, analytics, and digital transformation capabilities for defense and national security missions; closing remains subject to approvals and is expected in Q4 2026.

GSA’s proposed FY27 budget requests $435.5 million in net discretionary authority and outlines priorities spanning AI-enabled procurement, cloud migration, cybersecurity, FedRAMP, Login.gov and service modernization. The request signals potential future demand, but identifies no specific solicitations, contract values or awards; GSA leaders are scheduled to discuss priorities at the October 29 FedCiv Summit.

Google Public Sector is accepting early adopters for Gemini for government services, an AI offering designed for regulatory analysis, FOIA redaction, bid review, and workflow automation. The preview creates evaluation and potential integration opportunities, while federal agencies can access discounted Gemini through OneGov until November 15, 2026; no solicitation, contract value, or general availability date has been announced.

USCIS expects to compete a follow-on Enterprise Contact Center Experience 2 contract valued at $50 million to $100 million, with a solicitation anticipated March 1, 2027. The opportunity covers cloud-smart, AI-enabled contact center services in Camp Springs through December 30, 2032, and could draw competition against incumbent AT&T.

Palantir Technologies and Knox Systems announced a partnership to help deliver commercial software to U.S. government customers in FedRAMP- and IL5-regulated cloud environments. Knox says its authorization path can achieve FedRAMP authorization in 90 days or less, but the announcement disclosed no government award, solicitation, or contract value.

Ariento and Carahsoft have partnered to distribute Enclave One, a bundled CMMC Level 2 offering for Defense Industrial Base organizations, through Carahsoft’s reseller network. Starting at $499 per month, the package includes a managed environment, Microsoft 365 GCC or GCC-High licensing, documentation, security operations, and an independent C3PAO assessment; eligible organizations may onboard in as little as 72 hours and reach certification reflected in SPRS within 90 days.

GovExec will convene government, technology, cybersecurity, and policy leaders in Reston on November 19, 2026, to discuss practical agency implementation of Zero Trust across identity, data, networks, and AI-driven security. Contractors can use the event for market research and business development, but it is not a solicitation or indication of a specific award.

A WashingtonExec op-ed warns that AI is accelerating cyberattacks and urges federal agencies to strengthen access controls, patching, incident response, and oversight of AI adoption. The priorities may create opportunities for contractors in cybersecurity services and post-quantum readiness, while CISA’s existing CDM program offers an established pathway—not a newly announced solicitation or award.