Cybersecurity · Industry brief

The Department of War delayed implementation of CMMC Phase II and suspended all subsequent phases of the Cybersecurity Maturity Model Certification program, postponing November 2026 rollout of third-party cybersecurity assessment requirements for defense contractors. The department established a task force for a 60-day review and requested industry feedback on reducing CMMC compliance costs and administrative burden, while underlying cybersecurity requirements remain in place with continued reliance on contractor self-assessments. The Department of Justice announced that TransDigm Group abandoned its proposed $960 million acquisition of Stellant Systems after DOJ indicated intent to challenge the transaction. Both companies manufacture and repair defense and industrial components for the US Navy and Air Force, and the DOJ stated it will continue to rigorously investigate and challenge mergers creating monopolies and harming competition in national security–related markets.

The Pentagon awarded Oracle a nearly $7 billion Enterprise Software Agreement to consolidate all of Oracle's on-premises products and services into a single contract vehicle, according to Nextgov/FCW (July 24, 2026). The five-year deal with a five-year option period has an initial base value of $3.31 billion and can reach $6.99 billion over ten years. The consolidation is expected to generate at least $441 million in taxpayer savings and covers the entire Department of Defense, U.S. Coast Guard, and Intelligence Community. This follows the Pentagon's May announcement of a similar $9.7 billion software consolidation deal with Dell Federal Systems for Microsoft licenses, reflecting a broader government trend toward centralizing enterprise software procurement.

According to Censys's internet exposure report preview, North America accounts for approximately 38% of internet-exposed industrial control systems as of early 2026, with the total number of exposed ICS devices growing from 129,000 in 2024 to 138,000 in early 2026. The report also highlights a surge in publicly accessible AI tools, with detected IP addresses associated with AI services jumping from 183,000 in October 2025 to over 294,000 in early 2026, including significant growth in vulnerable AI agent-building tools like Langflow (up 169%) and LiteLLM, both of which carry critical remote code execution and pre-authentication vulnerabilities that expose critical infrastructure and enterprise systems to exploitation risks.