Nextgov/FCW - All Content

OneGov savings balloon to over $1.6 B as agencies weigh future of AI in contracting

Christian Robles — Thu, 13 Aug 2026 16:25:09 -0400

The OneGov program has saved the federal government about $1.62 billion — including about $1.4 billion through limited-time discounts on artificial intelligence — since its inception, a General Services Administration official said Thursday.

“That number may not capture the full impact because some agencies might have used the OneGov pricing to negotiate pricing on their own contracts outside of GSA’s [involvement],” Birgit Smeltzer, director of the agency’s Office of IT Products, said at the GovCIO Federal AI Forum.

Indeed, the Centers for Medicare and Medicaid Services is one example of an agency that has negotiated technology discounts beyond OneGov. But federal agencies only have limited time access to discounted software through the OneGov program.

Smeltzer said some of the original equipment manufacturers have already agreed to extend the duration of their OneGov discounts or are working on forging new offers. She did not say which manufacturers have already promised to reup discounts or when GSA would announce them.

“Some of the [original equipment manufacturers] have already agreed to extend some of the limited time offers, and some are looking at producing new offers for us,” she said.

GSA officials previously said they want manufacturers to extend OneGov deals as they look to become direct contractors on the Multiple Award Schedule. Officials have also said they want the OneGov initiative to extend beyond technology and software.

Smeltzer forecasted that even though OneGov prices “will eventually increase, the offers have already created significant value for agencies.”

“Leveraging the OneGov has been tremendous in order to really prove value,” said Geoffrey Sage, director of the enterprise services and analysis division within NASA’s Office of Procurement.

OneGov is just one way agencies are thinking about AI and contracting.

NASA has started to talk with industry about how it should use AI in contract evaluations, Sage also said at Thursday’s event. That specific application of AI has been a “thin red line” for the agency to date but it's also a “necessity,” he added, while noting that NASA takes a risk-based approach in deciding to use AI.

“We spend 85 percent of the agency's budget through procurement,” Sage said. “We can't afford AI to trip up and hamper our source evaluation process.”

Federal use of AI to evaluate contracts has recently garnered scrutiny, with some contractors alleging agencies are misusing the technology and relying on hallucinations in their evaluations.

NASA is also using AI to bring its number of contract writing systems down from three to one next year, Sage said.

Federal officials should view industry as collaborators, Anil Chaudhry, senior AI advisor for the Transportation Department, also said at the event.

“As a government employee, you can no longer have a mindset that you're competing with industry. You have to have that mindset that you're collaborating with industry,” he added.

]]>

CISA just changed the rules. Is your vulnerability program ready?

Tim Miller — Thu, 13 Aug 2026 16:08:00 -0400

The attacker is already inside. Not hypothetically – statistically. Nearly half of organizations that experienced a production security incident last year were breached through a vulnerability their own team had already identified. They knew it was there. They just didn’t get to it in time.

On June 10, CISA decided that “in time” now means three days. Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk rewrites how federal agencies prioritize vulnerability remediation and for defense contractors watching closely, it’s a preview of what’s coming for them next.

The directive does something deceptively simple. It tells agencies to stop treating every vulnerability as equally urgent. It establishes four criteria: whether an asset is publicly exposed; whether the vulnerability is actively exploited; whether exploitation can be automated; and whether exploitation yields full system control. It then ties remediation timelines to how many factors apply. A vulnerability that checks all four boxes must be patched within three days. Roughly 60% can be deferred entirely.

The average organization takes 55 days to patch half its critical vulnerabilities. Three days is more than a tightening of standards. It is a different game entirely.

The gap this directive is trying to close

BOD 26-04 lands in a specific threat context. The mean time to exploit known vulnerabilities has dropped to an estimated seven days, and exploitation now routinely occurs before a patch is published. Threat actor alerts increased 225% between 2024 and 2025. The fastest observed attacker breakout time from initial access to lateral movement is now 27 seconds.

What's accelerating that window is AI. Most discussion about AI and cybersecurity focuses on zero-days, which are a real concern. But the more immediate problem is what AI does to known vulnerabilities that have been disclosed but remain unpatched. WannaCry arrived 59 days after its patch. Citrix Bleed took two weeks. That window is collapsing. BOD 26-04's deferral model is being issued into a threat environment where a vulnerability assessed as non-urgent today could have a working exploit by tomorrow.

This is why the traditional model to scan, score, queue, and patch no longer works. CISA's acting director Nick Andersen put it plainly: the agency has to be willing to say some systems are less important than others, and direct limited resources toward the risks that actually matter. A critical vulnerability is not always a critical risk. Without context, severity scores are noise. The right question is “which exposures matter to us right now, given what adversaries are actively doing?”

Detection is not the gap. Prioritization and speed are.

What the directive doesn’t solve

BOD 26-04 formally applies to federal civilian Executive Branch agencies, not contractors yet, but CISA's own Implementation Guidance directs agencies to ensure appropriate remediation timelines are part of service-level agreements or that service providers establish a contractual arrangement. Contracting officers will likely incorporate these requirements into Statements of Work as agencies act on that guidance. For defense industrial base contractors, CMMC sets the floor for what must be protected. BOD 26-04 is raising the ceiling on what operational readiness actually requires.

There are also two structural limitations practitioners need to understand.

The first is the deferral problem. Deferred is not the same as resolved. The 60% of vulnerabilities the directive allows agencies to defer don’t sit in a static threat environment; exploit timelines are compressing and actor groups pivot targeting constantly. A vulnerability assessed as low-urgency in June can be actively exploited by August. Defenders also need to account for vulnerability chaining: attackers frequently combine lower-severity vulnerabilities to gain a foothold, then escalate toward critical systems. A vulnerability that would never independently trigger the three-day clock can become a critical exposure when paired with one that opens a lateral movement path.

The second is control posture drift. BOD 26-04's first criterion – whether a vulnerable asset is publicly exposed – sounds like an inventory question. It is a continuous control validation problem. Exposure state changes constantly as firewall rules drift, cloud configurations shift, and new services are stood up. A vulnerability behind a compensating control can become a three-day priority the moment that control fails silently. Most programs won’t know until the next scan.

What compliance actually requires

Consider the same vulnerability disclosure under two operating models.

A defense agency cyber team receives intelligence that a known adversary group is discussing exploitation of a newly disclosed flaw in a widely used remote access tool. Under a traditional model, the alert joins a queue: CVSS score assigned, patch cycle pending. Under a continuous exposure model, the alert is correlated immediately with vulnerability footprint, current control effectiveness, and mission dependency. The team understands what the adversary can actually do given the controls in place right now, rather than the controls documented in the last assessment. Remediation begins before the KEV catalog is updated.

A CMMC Level 2 subcontractor faces the same disclosure. A lean team, under a traditional model, lacks the context to know whether it's relevant. Under a continuous exposure model, questions about whether this is in our environment, whether we are a target profile and if adversaries are actively exploiting similar organizations have answers before anyone asks.

The difference between a managed risk and a contract-jeopardizing incident is the time between alert and a contextualized picture of what it means.

The real ask

BOD 26-04 is a mandate about process. What it implies is a mandate about intelligence.

CISA is right that prioritization is the real lever. The directive creates a risk-based framework where none existed and will force conversations that have been deferred for years. But it only holds if the intelligence running underneath it is continuous. The three-day clock requires knowing which systems match the exposure profile. The deferral model requires watching deferred vulnerabilities as the threat environment evolves. The control posture criteria require visibility that reflects what’s actually enforced now, rather than last quarter’s scan.

That is the real ask of federal agencies today, and the defense industrial base shortly. CISA just put a deadline on it.

Tim Miller, Dataminr’s Global Field CTO and Chief Cybersecurity Strategist, has nearly two decades of experience helping public sector organizations adopt and leverage emerging technologies.

]]>

GAO official suggests addressing AI risks through existing legislation

Alexandra Kelley — Thu, 13 Aug 2026 15:09:00 -0400

As Congress continues to wade through legislation focused on the various aspects of artificial intelligence, an official at the congressional watchdog — the Government Accountability Office — said lawmakers are going about AI safety the wrong way.

Nick Marinos, GAO’s managing director of IT and cybersecurity issues, said the legislative approach to addressing newfound cybersecurity and other risks presented by advancing AI models is too reactive.

Speaking during a GovCIO AI event on Thursday, Marinos said lawmakers need to go beyond thinking about cybersecurity risk mitigation policies and focus on eradicating them altogether.

While he acknowledged that positive strides have been made in catching up with new technologies at the government level — such as the creation of the Cybersecurity and Infrastructure Security Agency and the Office of the National Cyber Director — Marinos said the government remains “behind the eight ball” in regulating AI-related threats.

“If you look at a lot of the AI safety bills, think about the need for us to update key legislation,” Marinos said. “It's really more about stepping away from thinking that we're going to address all the vulnerabilities, but more so thinking about ‘how can we close the door as much as possible,’ and then ‘how can we be very quick to respond and react when there is an incident’ as well.”

Some of the key legislation Marinos referred to included the Cybersecurity Information Sharing Act of 2015. The law created a voluntary attack sharing mechanism between the government and private sector, provisions that are set to expire this coming September.

The Senate approved a short-term funding measure on Aug. 8 that would extend the Cybersecurity Information Sharing Act until Dec. 11. The law temporarily expired during the 43-day government shutdown late last year, although Congress passed a funding package in February that extended the statute through Sept. 30.

The original text of the Cybersecurity Information Sharing Act does not address AI. Marinos said that one starting point to more proactive AI safety legislation could look like an extension to the existing law that includes information sharing AI-specific attack data.

“If it's a given that a vulnerability is going to be found, how are we monitoring activity to prevent the most catastrophic consequence to it?” he said. “It's going to take a full collaboration.”

GAO initially considered information security a “high-risk” area about 30 years ago, Marinos said, noting that even at the time the pace of technological innovation was moving at an exponentially faster rate than government guidance and action.

“We've seen too often that if one part of critical infrastructure is being affected by something, it probably is being affected in other places,” he said. “If they're not talking, or if the government isn't trying to facilitate that communication, then as a nation, we're not going to be well prepared to protect.”

Industry experts agree with Marinos’s point. Cyber Threat Alliance CEO Michael Daniel said that AI-related cyber threats could be mitigated with updates to statues in a landmark bill like CISA 2015.

“While one could make an argument that existing CISA 2015 protections cover that type of information, Congress should update the definitions in the Act to clearly cover information about threats to AI systems,” Daniel told Nextgov/FCW. “A single piece of legislation does not have to address every cybersecurity problem related to AI to be useful.”

]]>

Trump admin empowers private US firms to go after transnational cybercriminals

Christian Robles — Thu, 13 Aug 2026 12:40:00 -0400

The National Coordination Center will create a program allowing authorized U.S. companies to conduct cyber operations against transnational criminal organizations at the direction of the federal government, according to a memorandum signed by President Donald Trump on Wednesday.

Program executive directors from the departments of Homeland Security and Justice will have the authority to greenlight companies’ cyber operations unless the authorization would result in a loss of life, serious injury or “rise to the level of use of forced or armed attack under international law.”

The federal government would vet and conduct oversight of authorized companies, which would need to enter into contractual agreements with either DHS or Justice.

The specific standards the government will use to screen the companies will be drafted by the program executive directors — in coordination with the Homeland Security Council — within 60 days of the memo’s signing. They will include technical proficiency, proven performance of cyber operations, facility security, personnel vetting, competence and reliability, according to the document.

The group will ensure that program participation criteria enable involvement from large and small companies, and that operations target only transnational criminal organizations.

The memo also allows participating companies to enter into commercial agreements with other private sector entities, federal agencies and state entities. The program executive directors will produce a report on the initiative’s status and submit it to the National Cyber Director and Assistant to the President and Deputy Chief of Staff for Policy and Homeland Security Advisor.

The cybersecurity program seeks to build on a March executive order laying out steps to combat cybercrime. That order was released alongside a national security strategy that called for the government to more directly respond to adversarial threats and secure critical U.S. technologies.

In a statement, Mike Centrella — the head of public policy at SecurityScorecard — said the document “represents an important shift in how the United States approaches cyber threats originating overseas.”

“Strengthening defenses remains critical, but the memorandum recognizes that addressing cybercrime also requires identifying and disrupting the infrastructure and networks that allow criminal organizations to operate,” he said, adding that the guidance “signals an evolution in public-private cybersecurity collaboration — from primarily sharing information about threats toward combining government authorities with private-sector intelligence and capabilities to more actively disrupt them."

]]>

DARPA funds advancements in quantum networking

Alexandra Kelley — Thu, 13 Aug 2026 09:00:00 -0400

The Defense Advanced Research Projects Agency is exploring how to scale the reliable transmission of quantum data and pave the way for a viable quantum internet by giving networking networking company Qunnect an award to further deploy networks designed to handle qubit traffic.

Pursuant to the contract, Qunnect is granted new funding to further deploy its Carina quantum networking solution, the company announced on Thursday.

Qubits are naturally more fragile than classical bits, and transmitting them from one node to another has been a persistent problem in scaling a viable quantum network. Carina addresses several outstanding problems in safely transmitting quantum data by operating at room temperature, stabilizing environmental noise, maintaining entanglement during transmission and other engineering challenges.

Qunnect will specifically focus on refining Carina’s polarization compensation nodule, its internal system that helps reduce distortions in data transmission.

“Quantum networking has mostly stayed in the lab for decades because entanglement can be lost as a result of environmental factors like heat, wind and other everyday fiber movement,” Noel Goddard, CEO of Qunnect, told Nextgov/FCW. “Carina is the only commercial product built to cancel that noise out in real time, like noise-cancelling headphones for both buried and aerial fiber. This is one of the keys to Carina distributing entanglement over existing infrastructure instead of requiring purpose-built fiber or being limited to pristine lab environments.”

DARPA declined to comment on the award. Qunnect declined to disclose the exact amount of funding in the contract.

“We made an early commitment to designing instruments that operate on the same infrastructure the world already uses,” Goddard said. “For the past five years, we focused on making quantum networking practical, and we’ve validated it through deployments in cities, and through partnerships with private industry and growing support from government agencies. We know that reliability is what will separate proof-of-concept demonstrations from useful networks that enable tomorrow’s applications.”

Quantum networking has received more attention at the federal level recently as the quantum computing industry looks to reach new levels of maturity and successfully share data between fault-tolerant machines. In 2025, DARPA unveiled its QuANET initiative, which aims to marry components of classical and quantum systems together in a functioning hybrid network.

Goddard said that Qunnect’s award is a standalone Small Business Innovation Research award.

President Donald Trump released an executive order earlier this year focused on advancing quantum information sciences and technology research that specifically focuses on spurring the development of a distributed quantum computing network, tasking agencies including the Department of Energy, Department of Commerce, the National Science Foundation and NASAn to craft and submit five-year roadmaps documenting their efforts to expand quantum networking.

]]>

OpenAI Foundation gives $100 million fund state AI implementation for public health

Alexandra Kelley — Thu, 13 Aug 2026 05:00:00 -0400

OpenAI Foundation, the overarching nonprofit that governs OpenAI, has announced a new public health partnership with the Common Health Coalition to bring artificial intelligence tools to developing scientific breakthroughs for medical research across the country.

OpenAI Foundation on Thursday announced its commitment of $100 million to the Breakthroughs to Follow-Through Initiative, a program where states and other local jurisdictions can accelerate medical treatment research deliveries for serious health conditions. Participating jurisdictions will be able to determine what types of AI tools, including generative AI, are needed for their individual projects.

The B2F’s research funding will initially focus on hepatitis C treatment development. Local organizations and non-profits will be in charge of dispersing grant money — first in states including Alabama, Illinois, Louisiana and Massachusetts. More state participants will be unveiled in the coming six months.

“The organizations closest to society’s greatest challenges have the deepest understanding of what communities need, but not always the resources or technical expertise to harness the latest advances in AI,” Anna Makanju, Head of AI for Civil Society and Philanthropy at OpenAI Foundation, said in a press release. “We believe this initiative is a model for how AI can strengthen public and community health work and deliver tangible benefits to communities.”

Makanju told Nextgov/FCW that the foundation’s grants aren’t tied to one AI platform or system provider, granting participants flexibility in the tools they choose.

“We want our partners to have the agency to decide which tools to use — or what not to use — and to choose what best fits their needs and the communities they serve,” she said.

Dave Chokshi, the chair of the Common Health Coalition, echoed Makanju’s sentiment.

“Jurisdictions will determine which tools are needed to help ensure existing medical breakthroughs actually reach the people who need them,” Chokshi told Nextgov/FCW. “These tools range from identifying people overdue for screening or treatment, to outreach platforms for re-engaging patients, AI copilots that free up clinicians' time, navigation tools that keep patients on track through cure, and beyond, and are intended to support the human relationships at the center of care.”

In addition to offering access to advanced AI tools, Chokshi said that B2F will provide the infrastructure needed to facilitate the implementation and usage of AI tools, such as technical support to help shift from the pilot stage into deployment.

The current focus of B2F is to foster collaborative state-level partnerships, but Chokshi said they are open to participation from the federal government.

“We remain very open to partnership and collaboration with the federal government as this work develops,” said Chokshi.

A similar initiative was previously floated in congressional legislation. Rep. Michael McCaul, R-Texas, introduced his bill on July 9, — the Accelerating Innovation for Kids with Cancer Act — to allocate more federal attention to leveraging AI to aid pediatric cancer research efforts.

]]>

Pilotless Air Taxis Are Here. Your Daily Commute? Still Stuck on the Ground.

Camille Tuutti — Wed, 12 Aug 2026 18:06:00 -0400

I've never had a driver's license. I've been waiting for the flying car since I watched "The Jetsons" as a kid. Forty years later, pilotless air taxis are finally showing up, just not quite how the cartoon promised.

A pilotless air taxi route between Shenzhen and Hong Kong has been announced: 20 minutes, about 800 yuan ($110) a seat, nobody in the cockpit, the flight path preprogrammed and monitored from a ground command center.

At a low-altitude economy expo in Guangzhou in December 2025, EHang said its EH216-S autonomous air taxi would begin cross-border service that January. Coverage of the announcement repeated the same numbers: 20 minutes, 800 yuan and a shortcut between two cities about 25 miles apart in the Greater Bay Area, Beijing's name for the Hong Kong-Shenzhen-Guangzhou megaregion.

This is about as close as anyone has come to a real flying-car service, so I went looking for someone who could tell me more. Emails to EHang went unanswered. I blame the summer vacation season. Here's what I found instead:

The aircraft exists and it's certified. The EH216-S seats two, uses 16 propellers, tops out around 130 km/h (80 mph) and has a maximum range of roughly 30 km, or about 19 miles. China's civil aviation regulator has issued a type certificate, a standard airworthiness certificate, a production certificate and, through its operators, the first air operator certificates for civil pilotless, human-carrying eVTOL flights.

So far, those approvals have covered sightseeing loops, tightly controlled test routes and early ticketed services rather than open-ended city-wide transport. In EHang's own descriptions, the initial phase focuses on tours and flight experiences, often taking off and landing at the same vertiport, with broader regular scheduled service presented as a later step.

EHang and the trade press now describe the Shenzhen-Hong Kong route as live and bookable, with multiple daily autonomous flights at around 800 yuan a seat, which EHang bills as the world's first cross-border, fully autonomous passenger eVTOL service.

Nearly everything I can find on how often these flights run, and how reliably, traces back to EHang, its partners or the eVTOL trade press; the big global outlets haven't covered it. That's not enough to call this a daily commuter corridor.

There's a reason announcements come early. Shenzhen pays subsidies for new cross-border routes to Hong Kong, plus bonuses tied to flight activity, and Guangdong province runs its own program for eVTOL operators. You can get paid for announcing a route and paid again for flying it, even while the service itself stays small and expensive.

EHang is working on longer-range aircraft, and Hong Kong has opened a regulatory sandbox for advanced air mobility. Joby, Volocopter and Lilium are running piloted eVTOL demos in the U.S. and Europe under similar programs. Add it all up and you get a handful of tightly controlled test routes and a few ticketed corridors, far from a city-wide network.

Right now, if you actually want to buy a ticket on a pilotless flying taxi, China is the only place anyone claims you can, and EHang is the company running those flights. Everyone else is still in demos, sandboxes or working through certification.

Four decades after "The Jetsons" aired, someone did build the aircraft. It's certified and it flies. I'd just like one that goes somewhere I actually need to be.

]]>

VA seeks to extend its Oracle health record contract through 2031

Edward Graham — Wed, 12 Aug 2026 17:43:00 -0400

The Department of Veterans Affairs is looking to extend its contract with Oracle for an additional three years to finalize its electronic health record modernization project, according to a SAM.gov notice that was published Tuesday.

VA initially contracted with Cerner in 2018 to modernize its legacy health record system. Oracle subsequently acquired Cerner in 2022 and rebranded the new unit as Oracle Health.

The EHR modernization project is part of a broader government effort to implement a single, interoperable federal EHR across several agencies like the Defense Department, Coast Guard and National Oceanic and Atmospheric Administration.

While the other agencies have largely completed deployments of the new software, VA has faced numerous challenges since it first went live with the new EHR system at the Mann-Grandstaff VA Medical Center in Spokane, Washington, in 2020.

Issues with the software and clinician use of the system — which included adverse patient safety outcomes — ultimately led VA to renegotiate its contract with Oracle in May 2023. The revised contract includes additional accountability measures and changes the terms of the deal from an additional five-year term to five one-year terms.

Under the proposed extension, the current agreement between VA and Oracle would be modified to consist of an additional three one-year optional ordering periods.

That would potentially extend the contract through May 16, 2031. The current deal is set to expire in May 2028. Agency officials have said they are hoping to complete deployments of the new EHR software at every VA medical facility by 2031.

“Specifically, this modification will increase the overall contract ceiling and extend the Period of Performance,” the notice says. “This action is necessary to continue [electronic health record modernization] deployment activities and associated support services until all VA Medical Centers (VAMCs) and related facilities have fully transitioned to the EHR system.”

The notice adds that “the intended sole source for this firm fixed price modification is Oracle Health Government Services, Inc.”

Although accompanying documents attached to the notice say “this modification will increase the total contract ceiling value from $9,996,557,385.06,” both the proposed increase and new total contract ceiling are redacted.

The announcement comes as VA, under the leadership of Secretary Doug Collins, has prioritized completing the large-scale EHR modernization project after it was slowed for years by safety and usability challenges.

VA paused most new deployments of the EHR system in April 2023 to address the host of issues plaguing its implementation across VA’s network of 164 medical facilities. At the time the agency initiated its “reset period,” the software had only been deployed at five sites.

At the end of the Biden administration in December 2024, VA announced plans to resume rollouts of the system at four Michigan-based medical sites in mid-2026. Collins subsequently moved to scale up the number of go-lives in 2026 by adding nine medical facilities to VA’s 2026 deployment schedule.

VA has successfully deployed the new software at eight medical facilities so far this year, with plans to go live at three more sites on Aug. 22 and then two more on Oct. 24.

Collins told lawmakers in May that, under his leadership, the EHR rollout resumption push has been “phenomenal.”

]]>

Palantir’s no-bid pipeline just got bigger

Nick Wakeman — Wed, 12 Aug 2026 16:11:41 -0400

Palantir has secured another lucrative commitment from the Defense Department, with a pledge of up to $243.9 million in funding for the company’s software between now and March 31, 2027.

Deputy Secretary of Defense Steve Feinberg has also directed DOD departments to identify options for more spending on Palantir products from April 1, 2027 and Dec. 28, 2028.

In a memo viewed by WT, Feinberg says Palantir's software is "providing valuable support to improve efficiencies with the defense industrial base." Feinberg highlighted DOD's use of the software to flag delays in munitions and delivery-vehicle production and maintenance.

Feinberg made no mention of specific contracts or vehicles.

The action follows a July award of a 10-year, $10 billion Army agreement that consolidated many of Palantir’s existing contracts into a single pact.

The Feinberg memo appears to be part of a trend in federal contracting, where no-compete contracts are growing as a percentage of all awards. No compete contracts accounted for 14.8% of all awards in the first half of 2026, compared to 12.6% for the same period in 2025.

Federal News Radio reported that DOD said it has issued similar memos involving other companies.

No compete contracts are allowed in the Federal Acquisition Regulation, which gives agencies the process for documenting why a sole-source contract is the best use of federal funds. Reasons for a no-compete contract can include urgency, only one responsible source, critical follow-on work and national security.

Feinberg's memo mentions none of those reasons for directing the spending to Palantir.

Palantir's portfolio of no-compete contracts includes an Agriculture Department award for the One Farmer, One File program. Agriculture also turned to Palantir's software for the department's return-to-the-office initiative.

According to GovTribe data, the company has received $3.2 billion in contract obligations since 2024 and roughly half of those dollars came through no compete contracts.

In Palantir's second quarter earnings release on Aug. 3, the company reported 93% in the second quarter compared to the same quarter a year ago. Total revenue reached $1.9 billion.

U.S. government revenue grew 90% year-over-year to $809 million.

Palantir also is ranked No. 40 on the 2026 Washington Technology Top 100, up 22 spots from the 2025 rankings.

]]>

NIST wants to outfit the National Vulnerability Database with AI

Alexandra Kelley — Wed, 12 Aug 2026 14:22:00 -0400

The National Institute of Standards and Technology is looking to augment its central repository of digital vulnerabilities with help from artificial intelligence.

In a new Request for Information published in the Federal Register on Wednesday, NIST said it is seeking input surrounding how to best modernize its National Vulnerability Database by leveraging AI to enhance how the agency documents and responds to identified cybersecurity weaknesses.

The NVD documents digital vulnerabilities, cataloguing their severity, impacted products and other relevant data. Some of the challenges to modernization the RFI seeks to address include growth in both the number and complexity of newly disclosed vulnerabilities, a diverse range in data quality, a reliance on automation and machine-readable security data and the emergence of AI-assisted vulnerability discovery.

“The advancement of AI presents an opportunity to transform the vulnerability management ecosystem,” the document reads. “This requires input from across the community to ensure this ecosystem is effective, scalable, and resilient in the face of emerging threats.”

The RFI seeks feedback to better understand how AI tools can improve the broad vulnerability management lifecycle and ecosystem, enhance risk assessment efforts and better remediate vulnerabilities.

NIST is also looking to learn more about what, if any, changes need to be made to existing organizational structures and standards to improve both the data quality and procedural handling of vulnerabilities.

Rapid advancements in AI technology and its impact –– both as an asset and adversary –– on cybersecurity has been a paramount tech policy issue, reaching a climax after models from both OpenAI and Anthropic escaping containment environments. Prior to these incidents, the White House had turned its attention to addressing the cybersecurity impacts of AI, including multiple cybersecurity action items in a June executive order.

As part of the EO, the Trump administration created an AI-supported vulnerability clearinghouse within the new Gold Eagle initiative. Gold Eagle is primarily a coordinated vulnerability sharing effort. A NIST spokesperson told Nextgov/FCW that its effort to modernize the NVD is not related to any recent executive action.

“Our RFI is not in response to any specific executive orders or to the Gold Eagle Initiative,” the spokesperson said. “However, we expect that tools like the NVD will continue to play an important role in the broader vulnerability management and coordination ecosystem.”

]]>

DISA sets release date for follow-on cloud solicitation

Nick Wakeman — Wed, 12 Aug 2026 13:36:00 -0400

The Defense Information Systems Agency's newest acquisition schedule pegs an expected final solicitation release date of Aug. 24 for the next iteration of the military's main cloud computing contract.

The Joint Warfighter Cloud Capability contract is the Defense Department’s vehicle for buying cloud services from the main hyperscalers – Amazon Web Services, Google, Microsoft Azure and Oracle.

DISA's expected release date was part of the agency's August acquisition decisions posting on its website.

The new version will be called JWCC Unified Cloud Marketplace and expands what DOD can buy through the vehicle.

Tier 1 will be for the hyperscalers. Tier 2 covers “everything-as-a-service” including software, platform, and non-hyperscale infrastructure.

Tier 3 is reserved for what DISA is calling “Commercial innovators and small businesses.” This tier will be populated by emerging companies and small businesses.

DISA has not posted an estimated value for JWCC Unified Cloud Marketplace. The current JWCC vehicle had a $9 billion ceiling.

Deltek data indicates AWS has received $526.5 million in task order obligations, followed by Microsoft at $221 million. Oracle is next at $76.9 million and Google stands at $35.9 million.

]]>

Amazon Web Services’ Dave Levy departs for Google

Frank Konkel — Wed, 12 Aug 2026 10:52:00 -0400

Dave Levy, vice president of AWS Worldwide Public Sector, has left the cloud computing and AI giant for a role with one of its primary competitors: Google.

Levy’s last day was Friday, July 31, an AWS spokesperson confirmed to Nextgov/FCW. A Google spokesperson declined to comment on Levy’s hiring.

Levy joined AWS in 2017 after a 12-year run as Apple’s head of U.S. government sales — first as vice president of U.S. government, nonprofit and healthcare, and ultimately leading AWS’ worldwide public sector business from 2023 onward.

David Appel, who formerly oversaw AWS’ national security and defense portfolio, has stepped into Levy’s former role in acting capacity, according to an AWS spokesperson.

Levy’s departure from AWS comes as the company nears the 15th anniversary of its GovCloud, which debuted in 2011 as the first cloud infrastructure accredited and designed for government customers. In the years since, AWS inked a series of major defense customers to multibillion-dollar cloud contracts, including the Central Intelligence Agency, the Pentagon, the National Security Agency and all 18 U.S. intelligence agencies.

A first-mover in the cloud computing market — Amazon Elastic Cloud Compute, or EC2, debuted 20 years ago — AWS remains the dominant market leader in the worldwide cloud computing market with nearly 28% of global market share.

Google’s business continues to grow, too. Google Cloud, the company’s suite of cloud computing services, is steadily gaining market share from competitors AWS and Microsoft, while the company’s AI technology, including its Gemini models, is fueling further growth as private and public sector customers clamor for AI offerings.

After a public falling out with the Pentagon in 2017 over Project Maven, Google launched a business unit in 2022 called Google Public Sector specifically designed to deliver cloud computing, AI and collaboration tools popular with its private sector customers directly to the public sector and Pentagon. Helmed by Google Public Sector Chief Executive Officer Karen Dahut, the bullish maneuver has paid off with Google’s software running in nearly every major federal agency, its latest Gemini models powering the Pentagon’s GenAI.mil platform and poaching away some longtime Microsoft 365 customers through its Workspace collaboration suite.

]]>

Oversight and program management gaps slowing VA’s benefits processing system modernization, OIG says

Edward Graham — Tue, 11 Aug 2026 18:45:00 -0400

Efforts to modernize a Department of Veterans Affairs system that supports the processing of veterans’ benefits claims have been hampered by “insufficient oversight and weak program management,” according to the agency’s Office of Inspector General.

The watchdog warned in an audit released on Tuesday that VA’s Office of Information and Technology has not taken all of the necessary steps to keep the revamp of the agency’s Benefits Enterprise Platform on track, which could potentially affect the processing of veterans’ benefits and other modernization efforts.

The BEP platform — one of 85 legacy systems that VA has identified as needing to be modernized or decommissioned to “improve overall efficiency of claims processing” — helps facilitate the sharing of information between the Veterans Benefits Administration and other “business line systems” that include pension, vocational rehabilitation and employment benefits.

VA awarded Booz Allen Hamilton a $1.1 billion contract in May 2021 to integrate its benefits systems into a new cloud-based Benefits Integration Platform, with the plan calling for the legacy BEP system to be migrated to this new service and then subsequently decommissioned. Although the contract was supposed to be completed this month, OIG noted that the latest timetable from VA said the BEP modernization effort is now slated to be completed in the second quarter of fiscal year 2034.

"Because BEP supports a significant number of systems, there is increased risk that other systems relying on it may experience negative consequences from potential delays in the modernization effort,” the report said.

The audit said the Office of Information and Technology failed to develop “a high-quality, reliable program schedule as recommended by the Government Accountability Office’s Schedule Assessment Guide” for the project and has instead relied on an agile project management tool for the effort — a tool that “does not contain roadmaps or detailed plans for the entire scope of the project.”

OIG also found that the office lacked a reliable lifecycle cost estimate for the modernization initiative, which has resulted in inconsistent funding information being included in various BEP plans and has “limit[ed] VA’s ability to make informed decisions.”

Lack of proper oversight, the watchdog reported, also may have jeopardized the security of veterans’ sensitive personal data when the office “hosted minor applications without conducting required security assessments.” After OIG notified VA officials about documented vulnerabilities — some of which dated as far back as 2021 — the watchdog said VA took the necessary steps to assess the security of its applications and remediate any identified issues.

OIG’s audit recommended that VA take steps to enhance its BEP modernization efforts, including by developing and maintaining a program schedule that aligns with best practices, ensuring that staff are following proper procedures when it comes to storing scheduling information, developing a “reliable, validated life cycle cost estimate” for the project and tracking all relevant project costs. VA officials said they concurred with the watchdog’s recommendations.

The BEP project is just the latest VA modernization initiative to be singled out for criticism by OIG for resulting in significant delays, cost overruns and oversight gaps.

VA is still in the process of developing a new digital GI Bill system, which the watchdog noted in an August 2024 report has seen its cost more than double as a result of “insufficient planning.”

The agency’s large-scale electronic health record modernization project has also been plagued by cost overruns, delays and oversight issues since the deployment effort began in earnest in 2020. The Trump administration has prioritized righting that effort, however, and VA Secretary Doug Collins said earlier this year that an EHR rollout resumption push has been “phenomenal” so far.

]]>

Trump admin delays TANF data sharing plan opposed by blue states

Christian Robles — Tue, 11 Aug 2026 17:43:00 -0400

The Trump administration pushed the effective date for a proposal allowing the Administration for Children and Families to share Temporary Assistance for Needy Families — or TANF — recipients’ information with other federal agencies to Sept. 1, according to a Federal Register listing posted last week.

Without the extension, the policy shift was set to kick in Tuesday, according to another Federal Register notice.

The delay comes as a coalition of Democratic attorneys general is requesting a federal district court vacate ACF’s proposal and declare it unlawful, according to an Aug. 3 filing.

The coalition alleged ACF could illegally share millions of TANF recipients’ Social Security numbers, marital status, income and other sensitive information with the Department of Homeland Security and other agencies if the Trump administration has its way.

That data sharing “will erode the trust that State agencies have developed with TANF recipients and will deter qualified beneficiaries from applying for TANF benefits, forcing Plaintiff States to spend more of their own money to ensure that families are housed and children do not go hungry,” the coalition said in the lawsuit filed in the U.S. District Court for the District of Columbia.

“If ACF can proceed with sharing TANF data with DHS, without clearly defined purposes and limits required by federal law, then community fears that DHS will use that data for other purposes will impede that public trust and chill participation in State TANF programs by citizens and qualified non-citizens alike,” the coalition added.

The group of attorneys general alleged that the administration’s data sharing plan is “arbitrary and capricious” under the Administrative Procedure Act. The coalition also claimed it violates the Constitution’s Spending Clause because states “could not have foreseen these potential uses and disclosures years ago when they collected and shared this data with ACF.”

An ACF spokesperson did not return a request for comment by the time of publication. The administration wrote in the Federal Register that its TANF data-sharing policies are designed to curtail fraud and ensure compliance with TANF requirements, such as verifying recipients’ immigration status.

A public comment period for the TANF proposal closes Tuesday. The federal government gave states and the District of Columbia nearly $16.5 billion in TANF block grants in fiscal 2024, according to the Congressional Research Service.

]]>

How OneGov is changing CACI's contractor role

Ross Wilkers — Tue, 11 Aug 2026 17:00:00 -0400

CACI International counts as business partners many of the same brand name technology companies that the U.S. government wants to have more direct relationships with, especially licenses for enterprise software platforms.

During CACI’s fiscal fourth quarter and year-end earnings call with investors Thursday, chief executive John Mengucci described that shift as having a “small revenue impact” and one resulting in “more positive margins.”

The General Services Administration’s OneGov initiative for unified technology procurements is the highest-profile example of how the government is seeking more direct relationships with commercial providers, including contracts for the product itself and associated licenses.

GSA is looking to obtain savings through volume discounts of tech products it believes can essentially be purchased in bulk and in a more consolidated manner and wants to do so on behalf of other agencies.

“Customers traditionally repurpose those savings right back to CACI, that gives us an ability to deliver additional capabilities,” Mengucci said.

Mengucci said that under the traditional model of integrators like CACI as primes, revenue was often reduced by the value of the licenses from the enterprise software providers. That revenue often provided CACI with “little-to-no margin,” he added.

CACI is experiencing the shift of who the prime contractor is firsthand in Federal HR 2.0 – the Office of Personnel Management’s effort to overhaul the government’s human resource systems by consolidating them into a single platform.

Oracle won the 10-year, $395.8 million contract over the summer and has enlisted CACI as a key teammate for the program alongside Baker Tilly and Deloitte. The core implementation will be based off of Oracle Fusion Cloud HCM.

In talking with analysts, Mengucci described the partial role-reversal of who the prime is as one of merely changing the order of things.

“What the OEMs (original equipment manufacturers) don't want, and generally aren't able to deliver, is the full implementation,” Mengucci said. “The government is going to them for the licensing first and then we are partnering with those folks.

“We've been in partnerships with them over the last eight-to-10 for a lot of those large enterprise tech jobs that we've put out there,” Mengucci added.

Fourth quarter revenue of $2.7 billion was 17% higher than the prior year period with an organic growth rate of 11%, while profit of $353.1 million showed a 33% year-over-year increase in EBITDA (earnings before interest, taxes, depreciation and amortization).

Full fiscal year 2026 revenue of $9.6 billion was 10.9% higher than the prior year period with an organic growth rate of 7.2%, while EBITDA of $1.2 billion showed a 21% year-over-year increase from FY 2025. CACI ended fiscal 2026 with an EBITDA margin of 12.3%, up from the prior year’s 11.2%.

CACI’s initial guidance for its 2027 fiscal year, which started July 1, pegs revenue in the range of $10.65 billion-to-$10.85 billion on an EBITDA margin in the high-12% range.

]]>

DHS wraps up Oracle's Cumulus cloud contract

Ross Wilkers — Tue, 11 Aug 2026 15:32:00 -0400

The Homeland Security Department has entered into the second out of four planned awards under Cumulus, a centralized mechanism for acquiring commercial cloud computing services across the entire organization.

Oracle’s portion of the potential five-year contract has a ceiling value of $567.9 million, DHS said in a Friday notice to Sam.gov. This follows DHS’ finalization in June of the award to Amazon Web Services, which is eligible for up to $2.5 billion under Cumulus.

DHS first laid out its intended timeline for wrapping up each Cumulus contract with all four of the hyperscalers, with awards to Google Cloud and Microsoft still in-the-works. The department originally pegged the end of the calendar year’s second quarter as its deadline for finalizing each contract.

Each award under Cumulus will cover a one-year base period and up to four option years.

Cumulus is designed to have a blend of competitive and non-competitive awards across all aspects of commercial cloud including infrastructure-as-a-service, platform-as-a-service and software-as-a-service.

After DHS finalizes each hyperscaler contract, the department will then work on creating a separate multiple-award competition to support the Cumulus effort.

]]>

The government wants your help solving today’s biggest challenges

John Breeden II — Tue, 11 Aug 2026 14:36:00 -0400

A few years ago, I tried to help a team of astronauts survive a Martian dust storm.

Fortunately, nobody was actually in danger. I was participating in the second NASA MarsXR Challenge, a government-sponsored competition hosted on the HeroX open-innovation platform. NASA wanted members of the public to design virtual reality scenarios that could someday help train astronauts for missions on Mars.

The first phase focused on storyboarding, so participants did not need to know how to program a VR simulation. They needed to imagine a realistic challenge, explain how astronauts would respond and take advantage of the immersive capabilities offered by virtual reality. My team designed a scenario in which astronauts left their rover behind while collecting rock samples in terrain too rough for a vehicle. When a surprise dust storm swept into the area and visibility began to collapse, they had to navigate back to the rover using digital waypoints and beacons they had placed along their route.

It seemed like a plausible worst-case scenario and, admittedly, a pretty exciting video game mission. The design required astronauts to think ahead, use the available technology and remain calm when conditions suddenly changed. Our entry earned an honorable mention in the first phase. We did not advance to the programming round, where winning concepts could be developed into functioning VR training missions, but the experience gave me a firsthand look at how seriously NASA approaches open-innovation competitions.

NASA has used HeroX and the NASA Tournament Lab to solicit outside ideas for everything from virtual reality astronaut training to building better lunar rover wheels. Some of the most visible government-sponsored challenges over the past several years have naturally focused on space exploration.

But one of the most consequential challenges open in 2026 is aimed at a problem that is far more Earth-bound and deeply human. The National Institutes of Health’s Office of AIDS Research is offering $1 million in prizes for ideas that could help more people gain access to long-acting HIV prevention and treatment. The competition, called the NIH ARISE-HIV LAUNCH Challenge, is open for first-round submissions through Aug. 6.

Federal government involvement goes well beyond an agency endorsement for the HIV Challenge. The Office of AIDS Research is the official sponsor and is providing the $1 million prize purse. The NIH Office of the Director is conducting the challenge under the federal prize authority established by the America COMPETES Reauthorization Act.

The challenge is also part of a broader program called Advancing Research in Implementation Science to End HIV, or ARISE-HIV. That effort involves all NIH institutes, centers and offices that award HIV funding or support related prevention, care and treatment research. HeroX provides the public competition platform, and the challenge appears through the NASA Tournament Lab’s wider open-innovation network.

To be clear, the current contest is not asking participants to invent a new HIV medication. Scientists have already developed long-acting products that can prevent or treat HIV without requiring patients to take a pill every day. Some are administered every two months, while others can provide protection for as long as six months. The challenge is getting those advances to the people who need them and making sure they remain connected to care.

In an August 2025 post reflecting on her appearance with NIH Director Jay Bhattacharya on The Director’s Desk podcast, Office of AIDS Research Director Geri R. Donenberg described the gap the new challenge is trying to address.

“We have effective, lifesaving interventions, but people are not benefiting equally,” she wrote.

Donenberg explained that implementation science can help determine how, where and by whom effective treatments should be delivered to reach different populations. An approach that works well for patients in one community may prove impractical in another because of transportation, cost, staffing, stigma, scheduling or limited access to health care.

That is where the LAUNCH Challenge comes in. NIH is asking participants to develop actionable ideas in at least one of four areas: access, delivery, engagement or retention.

An access proposal might explore how mobile clinics, home-based services, street medicine or pharmacists could bring long-acting products to people who are not well served by traditional health care systems. A delivery proposal could address the staffing or coordination needed to administer injections safely and reliably. That might include evening appointments, transportation assistance, child care support or better integration with mental health and substance-use services.

Engagement proposals could focus on building awareness, understanding and trust among patients and their families. Finally, retention ideas might help patients remain on schedule and connected to care during the months between appointments. But those are just a few suggestions. By all means, if you have better ideas, feel free to participate in this new challenge and earn a share of the prize money.

NIH is deliberately casting a wide net looking for precipitants. Individuals, informal teams, community organizations, health professionals, researchers, universities and companies can all participate. People and organizations that do not currently receive NIH funding are specifically encouraged to enter as the agency is looking for fresh and new ideas.

The first-round submission for the ARISE-HIV Challenge is pretty approachable. Participants need to complete an online concept submission totaling about three pages. Participants must also provide a short public abstract and identify whether their proposal addresses access, delivery, engagement, retention or some combination of those areas.

Judges will place the greatest weight on public health significance and impact, which accounts for 40% of the score. Innovation and novelty make up 35%, while the remaining 25% focuses on whether the idea is pragmatic enough to work outside a controlled research environment. HeroX and government officials explained the judging process and the importance of the challenge in a recent YouTube video.

Completed Phase 1 entries must be submitted through HeroX by 5 p.m. Eastern on Aug. 6. NIH expects to award as many as 35 first-round prizes of $10,000 each. Those winners will be invited into Phase 2, where they will develop more detailed implementation and evaluation plans. Up to 13 second-round winners could receive approximately $50,000 each.

And this is a busy time for government sponsored and federally focused challenges as the HIV event is not the only one being opened to outside solvers. The Department of Energy’s Office of Electricity recently launched the $500,000 Storage Design Strategies to Ease Production Prize, known as the Storage Design STEP Prize. It asks developers of emerging grid-scale storage technologies to identify manufacturing, material-sourcing and supply-chain obstacles before those problems prevent promising designs from reaching commercial production. Phase 1 entries are due Oct. 8.

Another active competition, the privately organized GoAERO Prize, is supported by NASA, RTX, Boeing, Honeywell, Iridium and other partners. Teams for that challenge are actually building compact, portable aircraft that could autonomously carry a person or emergency supplies into areas where conventional rescue vehicles cannot easily reach. Its final fly-off will take place at NASA’s Ames Research Center in April 2027. The best overall performer can earn $1 million, with additional prizes for missions involving rapid deployment, difficult conditions and precise maneuvering around obstacles.

The live challenges are radically different, but they share the same underlying idea. Agencies and other sponsors describe a difficult problem, establish rules and rewards, then open the door to people who may never have encountered the issue through a conventional grant, contract or government job.

My Mars scenario never became a functioning astronaut-training mission. But earning an honorable mention showed that someone outside NASA could still contribute an idea the agency considered useful. The next valuable idea may come from a community health worker who understands why patients miss appointments, an engineer trying to manufacture a new kind of battery or an aviation team that knows how to reach people stranded after a disaster.

For readers with a useful perspective, technical skill or firsthand understanding of one of these problems, the invitation is real: take a look, join a team or submit an idea. You may not win the top prize, but you could still contribute something that advances a technology, helps an agency or improves someone’s life.

John Breeden II is an award-winning journalist and reviewer with over 20 years of experience covering technology. He is the CEO of the Tech Writers Bureau, a group that creates technological thought leadership content for organizations of all sizes. Twitter: @LabGuys

]]>

Federal agencies quietly joined health data superhighway governing council

Christian Robles — Mon, 10 Aug 2026 17:37:00 -0400

Officials with the Consumer Product Safety Commission, Social Security Administration and Indian Health Service were added to the governing council for a federal initiative designed to facilitate the exchange of health data in June, Nextgov/FCW has learned.

The council’s recent additions highlight how agencies are increasingly eyeing participation in the initiative — known as the Trusted Exchange Framework and Common Agreement, or TEFCA — to obtain digital health records that would help quickly process disability claims, track consumer safety issues and improve medical care.

The new federal representatives on the TEFCA governing council are:

Brien Lorenze, executive director of CPSC
Sean Fry, executive advisor of health information technology and electronic records in SSA’s office of disability policy
Bobby Villines, acting director of the division of information technology within IHS’ office of information technology

The TEFCA website was updated Monday afternoon to list the governing council members, including federal representatives, after Nextgov/FCW inquired about new representatives. The governing council saw the federal members added in June, according to a spokesperson for the Department of Health and Human Services’ Office of the National Coordinator for Health Information Technology.

The governing council is tasked with monitoring health data exchanges, reviewing potential updates to the superhighway and helping resolve contentious cases of health information sharing, according to TEFCA rules.

The rules state that up to five individuals affiliated with a federal agency can sit on the governing council. The governing council can be expanded to include more federal representatives.

The ability for members to vote on the governing council depends on whether their agency is “actively involved in or enabling TEFCA exchange,” according to the rules. CPSC’s representative is a nonvoting member on the governing council.

How the agencies are leveraging TEFCA

The three agencies with new representatives on the TEFCA governing council are actively eyeing the health data sharing initiative to support agency procedures. Some are already receiving data through TEFCA.

In February, SSA announced it joined TEFCA to speed up disability benefits processing by more than 50% in some cases. Health systems using Epic electronic health records have already begun to digitally send SSA health information through TEFCA.

SSA has long pulled medical records through other health data superhighways known as Carequality and eHealth Exchange, but TEFCA has enabled additional hospitals and clinics using Epic electronic health records to send health information to the federal government, according to Epic. SSA specifically chose eHealth Exchange as its Qualified Health Information Network, or QHIN, which is essentially an onramp to the broader TEFCA superhighway.

An SSA spokesperson did not return a request for comment on the agency’s participation in the governing council.

In July, CPSC announced it will leverage a QHIN, Konza Health, to update its National Electronic Injury Surveillance System, or NEISS, a tracking system for consumer product-related injuries. The new system would allow hospitals in all 50 states to share vital medical information with CPSC and speed up the detection of hazardous consumer products, the agency said in a press release.

“As CPSC modernizes [NEISS to] NEISS-R, interoperability with the nation's health information infrastructure has become increasingly important. TEFCA provides a common framework for trusted health information exchange that can support authorized public health activities while promoting privacy, security, and standardized data exchange,” a CPSC spokesperson told Nextgov/FCW. “CPSC's participation reflects the mutual recognition that TEFCA and NEISS-R have complementary public health objectives and that collaboration benefits both efforts.”

CPSC’s partnership with Konza Health has garnered controversy from the likes of Rachel Maddow and consumer advocacy groups because it may sweep up personally identifiable information, such as names, addresses and birthdates, according to a KFF Health report.

Hospital technologists are also wary about the initiative because Konza Health officials have described medical record sharing as mandatory or else hospitals could be charged with violating federal information blocking rules, the report says.

The HHS office overseeing TEFCA invited CPSC to recommend a federal representative on the governing council in April.

IHS became the first federal agency to join TEFCA in December 2024 with eHealth Exchange serving as its QHIN onramp. As a health care provider to federally recognized tribes, IHS is using TEFCA to improve care coordination between agency and nonagency medical providers.

“The patients we serve are commonly shared with private sector, academic, or other federal healthcare providers. As such, the IHS has a clear interest in modernization and optimization of interoperability and coordination of care, and having a seat and a voice on the TEFCA Governing Council supports that interest,” an IHS spokesperson told Nextgov/FCW.

In addition to federal representatives, the TEFCA governing council has added several health IT industry bigwigs, including Alex Mugge and Hans Buitendijk of Oracle and Matt Becker of Kno2, Nextgov/FCW has learned.

]]>

Senate’s short-term funding bill provides temporary extensions for TMF, cyber data-sharing law

Edward Graham — Mon, 10 Aug 2026 17:25:00 -0400

The Senate approved a temporary funding measure this weekend that would provide a short-term extension for both the Technology Modernization Fund and a key cybersecurity law, although the proposal faces an uncertain future in the House.

The continuing resolution, which overwhelmingly passed the upper chamber in a 90-6 vote on Saturday morning, would punt funding for the federal government until Dec. 11. In lieu of further action and President Donald Trump signing such legislation, the government faces the likelihood of another shutdown beginning on Oct. 1.

The Senate-passed legislation, in part, extends the Technology Modernization Fund, a federal program that provides financial assistance to government technology projects. TMF was established in 2017 and helps support longer-term IT modernization initiatives while also having agencies pay back the investments that they received.

A Government Accountability Office report released last month found that TMF-funded projects have only resulted in about $13.5 million in savings through June 2025, although the watchdog estimated that 24 reviewed projects that received program funds between fiscal years 2018 and 2025 will result in roughly $1.06 billion in savings alone.

Saturday’s funding measure also provided a short-term extension for the Cybersecurity Information Sharing Act of 2015, a cornerstone cyber data-sharing measure that lets companies disseminate cyber threat intelligence with federal partners and one another while maintaining key legal exemptions. The law temporarily expired during the 43-day government shutdown late last year, although Congress passed a funding package in February that extended the statute through Sept. 30.

Trump administration officials have expressed a desire for lawmakers to extend the law for a prolonged period of time to enhance cyber information sharing.

National Cyber Director Sean Cairncross said during an event in May that the White House was “pushing for a long-term reauthorization” of the law, noting that the administration’s national cybersecurity strategy includes a focus on enhancing information sharing between the government and the private sector.

Lawmakers have moved to push the next federal funding fight until after the November midterm elections, although both chambers still need to come together to support one measure.

Saturday’s bill passed before senators departed for the August recess. The House, which is also slated to be out until Aug. 31, passed its own temporary funding measure on July 21. Senate Democrats, however, have called that bill a non-starter.

]]>

Senate Finance panel’s top Dem proposes excise tax on new data centers

Alexandra Kelley — Mon, 10 Aug 2026 17:12:00 -0400

A new draft white paper from a top Senate Democrat proposes tax code updates that would shift incentives for data center construction.

The paper, released on Aug. 6 by Sen. Ron Wyden, D-Ore. — ranking member of the Senate Finance Committee — proposes changing the incentives that could spur more data center construction amid the national boom in a bid to offset consumer burdens associated with more data centers.

Wyden’s framework hinges on two changes to existing tax code: removing the current tax incentives that apply to data center construction and applying a new excise tax on data centers whose workloads primarily handle AI compute.

With the removal of the tax incentive and the creation of an excise tax on data center operations, the new revenue would help address the myriad concerns with increased data center costs, including higher energy prices, workforce turmoil and a drain on broader resources.

“American communities are rightfully questioning whether the rapid buildout of data centers across the nation will benefit them, as local disruptions rise and Americans grow concerned about the long-term career prospects of millions of workers,” Wyden said in a press release. “These proposals are a first step towards safeguarding taxpayer dollars and ensuring there are resources to support American workers displaced by the coming disruptions to the economy.”

Wyden includes several caveats to his tax proposal. The new excise tax would function as a gross receipts tax that charges a fee the total revenue or sales of a business.

Two types of data centers will be subject to the tax: those owned, operated or rented by massive data center operators, and those being used by major data center payors, which include major hyperscalers Amazon and Meta. The paper stipulates that the tax would target the large AI hyperscalers and other entities that are primarily “causing the data center boom and most able to pay.”

Wyden’s proposal offers selective exemptions, which apply to data center assets constructed before 2024. It states that “for all but the largest actors,” the share of data center assets built before 2024 won’t be subject to the new tax.

“These proposals will not end data center development or put at risk the U.S. maintaining its

status as the global leader in AI and other innovative technologies,” the paper reads. “Rather, they will ensure we have the resources to help the communities and workers most impacted as data center construction continues.”

The proposal also says that the tax would apply to data centers in space. The draft paper stipulates that if a space-based data center attempts to avoid the tax by being labeled as a non-U.S. asset, a withholding tax will apply to payments made by U.S. taxpayers to use the data center. Space-focused tech firms, including Blue Origin and SpaceX, have proposed building millions of orbital data centers.

Wyden also solicited feedback on his proposal, calling for the public to provide the Senate Finance Committee’s minority staff with comments by Aug. 31. The paper said that discussion draft language is expected to arrive in the coming fall.

Data center construction and the question of who bears the burden of increased electricity rates and other potential hazards has become a major political talking point. Democrats, in particular, have been looking to leverage growing opposition to further data center construction as a political issue ahead of the 2026 midterm elections.

In March, President Donal Trump unveiled the Ratepayer Protection Pledge that brought companies Amazon, xAI, Oracle, Microsoft, Meta, Google and OpenAI to agree to absorb utility costs stemming from data centers handling their technology’s compute loads.

Other lawmakers have also turned their attention to issues brought about by the data center boom. Sen. Bernie Sanders, I-Vt., previously called for a moratorium on new construction until more information can be garnered about both data center impacts and AI itself.

“We cannot sit back and allow a handful of billionaire Big Tech oligarchs to make decisions that will reshape our economy, our democracy and the future of humanity,” Sanders wrote in February. “We need serious public debate and democratic oversight over this enormously consequential issue.”

]]>

Federal systems increasingly likely to face accidental AI breach after Hugging Face, experts say

David DiMolfetta — Mon, 10 Aug 2026 11:19:00 -0400

LAS VEGAS — An OpenAI agent tasked with finding software flaws escaped its testing environment, hacked into Hugging Face and spent days moving through the company’s systems in search of answers to an evaluation. It had not been sent to attack the company, yet it did so anyway — and a smattering of other accidental AI intrusions in separate environments have since followed.

If the same chain of events began again, former officials and cybersecurity experts told Nextgov/FCW there is little reason to assume a federal agency would be spared. In interviews during Black Hat and DEF CON this past week, they said aging networks, systems that are not properly separated and the government’s heavy reliance on contractors could present weaknesses that would let an unauthorized AI agent move from one environment into another before defenders realize.

One former federal chief information officer likened the risk to turning loose a hunting dog: “If you’re going to put your dog in the yard and instruct it to hunt, probably best to ensure the back gate is closed.” The former official spoke on condition of anonymity to discuss their views more candidly.

The July intrusion began during an internal OpenAI test designed to measure how effectively advanced models could find and exploit vulnerabilities. OpenAI said the agent — powered by GPT-5.6 Sol and a more capable internal research prototype — was operating with some security safeguards intentionally reduced.

The agent exploited a previously unknown flaw in an internal package-management service, reached the public internet and commandeered a third-party code sandbox as a staging point. From there, it exploited two flaws in Hugging Face’s dataset-processing systems, obtained credentials, executed commands and moved through parts of the company’s infrastructure.

In the leadup to the intrusion, OpenAI models created an internal message board, used it to trade hacking methods and found a way to bring it back even after humans shut it down, company engineers said in a presentation at the cyber conferences this past week.

The agent deliberately exploited Hugging Face’s systems in pursuit of its assigned goal, but OpenAI had not instructed it to attack the company. Bob Costello, who served as chief information officer at the Cybersecurity and Infrastructure Security Agency before becoming chief digital and information officer at Merlin Group, said a similar federal incident could begin with authorized security testing.

“As we start using really advanced AI to operate our systems or penetration-test our systems or blue-red-purple team our systems,” he said, “maybe one of those kind of goes sideways, [and] takes a lateral system to the side.” The color-coding he described refers to red teams that simulate hackers, blue teams that defend systems and purple teams that combine both approaches to find digital weaknesses.

That possibility is becoming more relevant as agencies begin experimenting with AI agents that can retrieve information and take actions. The General Services Administration is preparing a governmentwide hackathon in which federal, state and local employees will build connections between AI systems and agency data and public services, including prototypes that would let AI route data directly to an agency. The work is slated to be conducted exclusively in sandboxed environments and will not involve any access to restricted data or production systems.

Contractors may keep their federal and commercial systems separate, said Leslie Nielsen, the executive vice president and CISO at Mimecast, but the same employees may still access both: “There’s lots of people using it from both sides, and getting in through one could eventually lead to the other.”

“The chances of it happening again, I would say it’s going to,” he added. “Some of these [federal] infrastructures are just so big and, candidly, so old, that there are little nooks and crannies in them, they’re going to get teased out.”

Asked to assess the likelihood of a comparable federal incident, Ellen Boehm, senior vice president of internet-of-things strategy and operations at Keyfactor, called it “pretty likely” and placed the odds at “seven out of 10.”

Michael Leland, vice president and field chief technology officer at enterprise browser provider Island, said some civilian agencies are exposed because “they don’t have the infrastructure, they don’t have the talent, and they haven’t spent years building those guardrails or that containment because they didn’t have to.”

“It shouldn’t be different for AI because AI doesn’t care where it is,” Leland said. “It is opportunistic.” Agencies that don’t do national security work that have lower cyberdefense standards are “very much at risk,” he added.

Bob Ackerman, co-founder and managing partner at cyber venture capital firm DataTribe, also said many organizations have embraced powerful AI systems before learning how to reliably control them.

“We fundamentally are kidding ourselves that we’ve got this under control,” Ackerman said. “We’ve got a really, really powerful tool, but we don’t know how to control it yet.”

But people interviewed for this story largely rejected the idea that autonomous agents have rendered the government’s existing security playbook obsolete. The Hugging Face campaign relied on recognizable techniques like finding exposed systems, stealing credentials, escalating privileges and moving between connected environments, all of which are problems agencies have faced for years.

“It’s really not gonna play out all that differently than if it was a hands-on keyboard actor … or someone who’s writing a script and letting a programmatic algorithm go and do its thing,” said Ben Bernstein, who manages the cybersecurity advisors team at Huntress.

The difference, ultimately, is tempo and scale. An AI hacker can probe potential routes, link digital weaknesses and iterate its maneuvers without the delays of human intervention. Such tools maintain a relentless fixation on specific targets, persisting with an objective well beyond the point where a human operative might question the value of taking their selected intrusion path. On top of it all, they don’t need to eat, sleep or take restroom breaks.

“An agent’s just a fast hacker at the end of the day, right?” Nielsen said. “But the one thing the agent doesn’t have is a moral or ethical compass. They’re given a task and they have focus, and they’re going to go do what you’ve told them to do.”

David Weston, Microsoft’s corporate vice president of agentic security, similarly cautioned against treating the federal government as a fundamentally different kind of target. The approach demonstrated in the Hugging Face breach “is going to be a challenge for most folks,” he said, but the response still comes down to basic security practices.

“Regardless of the target, everyone needs to follow those fundamentals,” Weston added.

Duncan Greatwood, CEO of Xage Security, also said agencies should not rely on simply telling an agent not to perform certain actions because those instructions can be bypassed. Instead, they should use separate security controls that technically prevent the agent from reaching systems or changing data it’s not authorized to touch. He described the approach as “bounded autonomy.”

“You allow the agent to do stuff, but you’re not going to allow it to go crazy. You’re going to put hard bounds around it,” Greatwood said.

Retired Gen. Paul Nakasone, the former director of U.S. Cyber Command and the NSA who now leads Vanderbilt University’s Institute of National Security and sits on OpenAI’s board, called the Hugging Face episode “an inflection point in terms of AI-generated autonomous cyber attack.”

“My question is, how do we ensure that the defense starts to catch up, right?” Nakasone said. “How do we make sure that artificial intelligence is able to bring together a capable defense that allows us to do vulnerability detection, to do patching, to do incident response, and to do mitigation?”

Editor's note: This article has been updated to clarify the participants in GSA's upcoming hackathon and where the work will occur.

]]>

Cloudflare to seek DOD IL4 authorization after new FedRAMP, GovRAMP designations

Christian Robles — Mon, 10 Aug 2026 09:00:00 -0400

Cloudflare announced Monday it plans to seek Department of Defense Impact Level 4 authorization to bring a platform that can store and process controlled unclassified information to defense agencies.

The connectivity cloud company also achieved FedRAMP High certification, which covers civilian federal agencies, Thursday and GovRAMP Moderate authorization, which covers state and local governments, in April.

With the FedRAMP High certification, agencies can use Cloudflare for Government to process sensitive information related to national security, critical infrastructure and financial systems, according to a press release. The certification comes shortly after the FedRAMP director warned vendors they should not be allowed to sell products to agencies if they are too slow in patching vulnerabilities.

With the GovRAMP Moderate authorization, state and local governments can similarly use Cloudflare for Government to protect sensitive information and meet state-specific data privacy mandates, the release said.

“FedRAMP High, GovRAMP Moderate, and our intent to pursue DoD IL4 let us bring a platform to federal, state, local, and defense teams to advance their missions, retire legacy technologies, and accelerate their shifts to a more secure, efficient, and innovative future,” David Mihalchik, vice president of U.S. public sector at Cloudflare, said in the release.

The departments of Energy, Health and Human Services, Commerce, Homeland Security, Interior, Justice and State, in addition to other agencies, already use Cloudflare technologies.

]]>

Voting machine researchers say federal work abruptly ended after Trump ally pushed back on their findings

David DiMolfetta — Sun, 09 Aug 2026 06:00:00 -0400

LAS VEGAS — After spending roughly six weeks analyzing Dominion voting systems used in Puerto Rico’s 2024 elections, Mojave Research came back to the Trump administration with findings that startled its researchers.

The systems contained at least a dozen high- or critical-severity software vulnerabilities. Passwords were reused, firewalls were disabled and basic cryptographic protections were poorly implemented. And in Puerto Rico, active cellular hardware modems opened additional pathways into underlying software that was thought to be isolated.

But the small cybersecurity firm found no evidence that any of those weaknesses had actually been exploited, or that votes had been changed. The company still wanted more time to be certain.

Federal officials initially seemed willing to give them considerably more of it. The company was asked to grow the team working on the effort from roughly 10 people to about 60, according to CEO Jason Wareham.

Chief Technology Officer Manbir Gulati also said Mojave received an authorization to proceed with a follow-on effort, hired personnel and was given funding to acquire equipment for examining additional voting systems ahead of the November midterms. A contracting officer had even been brought in to finalize the new agreement, Gulati said.

Then, as Mojave prepared to move ahead, the work was abruptly shut down.

Wareham and Gulati recounted the episode on Friday at DEF CON hacker convention’s Voting Village, where they publicly unpacked their technical findings before sitting down with a small group of reporters and onlookers afterward.

Their account fills in new details about a federal effort that grew out of the Trump administration’s broader focus on voting machines and election interference, and the political pressures that emerged when Mojave’s findings did not support claims of election manipulation.

The ODNI request

Mojave never set out to become an election security provider. Its involvement began last year through the Office of the Director of National Intelligence under then-director Tulsi Gabbard, where it was already performing unrelated technical work for the agency when officials approached the company about examining voting machines and data obtained from Puerto Rico.

Reuters reported in February that the May 2025 operation was tied to an effort involving ODNI and the FBI to investigate allegations that Venezuela had hacked Puerto Rico’s voting systems, though Gabbard’s office denied that Venezuela drove its work and said the examination was focused on technical vulnerabilities. The probe produced no clear evidence of Venezuelan interference.

Wareham said at DEF CON that ODNI asked whether his team of reverse engineers and forensic specialists could travel to Puerto Rico and capture an image of a voting system that had actually been used in an election, without the vendor overseeing the process. He agreed, thinking it would be a relatively small addition to Mojave’s existing contract.

The assignment instead dropped Mojave into a much larger skirmish over American elections. “Ultimately, I made the worst decision of my life in a business context,” Wareham said.

President Donald Trump has spent years falsely maintaining that his 2020 loss was stolen and the product of widespread fraud and foreign interference, claims that have been rejected by courts and officials in his own administration. A 2021 intelligence community assessment found no indication that a foreign actor attempted to alter ballots, vote tabulations or any other technical aspect of the election.

Since returning to office, Trump and allies have revived investigations into the 2020 contest and pushed election security back to the center of his administration’s agenda. Gabbard’s ODNI was one part of that effort, hauling off and analyzing voting systems from Puerto Rico and later becoming involved in a federal investigation of 2020 election records in Georgia.

Wareham said the ODNI officials directly overseeing the company’s technical work wanted the research to continue. Both he and Gulati described the ODNI staff they worked with as professionals who wanted to protect the security of election systems.

The resistance, Wareham said, came from a separate White House collective that was repeatedly dissatisfied Mojave had not produced evidence supporting claims that the 2020 election had been manipulated.

“There was a separate group — let’s call them White House-adjacent — who was dissatisfied,” he said. “They were dissatisfied overall that I was not willing to name and shame at that moment” and declare that Trump had actually won the 2020 election.

Asked whether he believed Mojave’s government work was axed because it failed to find the “smoking gun” some officials wanted, Wareham said: “I believe that was part of the termination, yes.”

Reuters reported in April that Kurt Olsen, a prominent 2020 election-denier and Trump adviser involved in efforts to investigate the election, pressed Mojave to broaden its work in search of evidence that could support those claims.

Olsen, who now works at the Justice Department, turned against the company when its research failed to uncover evidence that the Puerto Rico machines had been hacked. He advocated terminating its work and accused Mojave of secretly receiving money from billionaire George Soros, a frequent target of right-wing conspiracy theories, the news agency reported. ODNI has said Mojave’s contract ended because the company completed its voting-machine analysis.

Wareham said an ODNI official informed him while Mojave was preparing to expand its work that the company had been accused of receiving Soros funding. The allegation prompted him to compile a detailed accounting of the young company’s funding sources within three days and send it up the government chain. Asked who he was told had made the accusation, he said an ODNI official reported to him that it was Olsen.

“One, I’m not funded by George Soros,” Wareham said. “Two, it would be great to be funded by George Soros because I would probably not be here, I’d be on a yacht.”

The company kept moving forward. Wareham said Mojave briefed the White House on some of its findings around September. The firm believed it was heading toward a broader effort to remediate vulnerabilities before the midterms and conduct a deeper analysis for signs that the weaknesses it discovered had ever been actually abused.

Then came the record-long government shutdown. Wareham said that on the day he expected an expanded contract to move ahead, Mojave instead received a stop-work order and no additional funding.

“I think the government shutdown was all that was required, really, to have some folks that I didn’t know were still in the game, again, White-House adjacent, to take their shot,” he said. Wareham stopped short of saying he had direct proof that White House officials ordered Mojave removed because of its findings, but said “it was reported to me it was Kurt Olsen” who led the efforts.

The White House, ODNI and Olsen did not return requests for comment.

Identified vulnerabilities

Mojave had found many issues with the machines it examined. Gulati described the Puerto Rico system during the Voting Village presentation as “deeply insecure,” saying it did not meet the security bar he would expect from “an average low-risk application, let alone critical infrastructure.”

Researchers identified at least 12 major vulnerabilities in commercial software installed on the system, Gulati said. Mojave successfully executed five of them. None were newly discovered flaws, and fixes were already available — in some cases well before the system was used in the election.

Other weaknesses were rooted more deeply in how the system was built and deployed. Some passwords could be easily cracked and others were embedded directly into software. Firewalls were turned off on critical systems and ports were left open. Gulati was particularly critical of the system’s cryptography, which he described as being “in shambles.”

The company does not believe every problem it found necessarily stopped at Puerto Rico, as its formal review covered only one system from one manufacturer in one jurisdiction. Gulati suspects the issues could extend beyond a single voting machine company, though Mojave has not examined enough systems from other manufacturers to establish that.

“I don’t expect that the problems are unique to them,” he said. “I think many manufacturers probably exhibit the same problems.”

Mojave produced an approximately 100-page document of the Puerto Rico findings. Gulati said Mojave has been in discussions with Liberty Vote — which acquired Dominion’s election business last year — and that Liberty told the researchers it does not plan to make changes before November.

Liberty said it has not received Mojave’s report.

“Liberty Vote is not in receipt of any such report so, therefore, we cannot provide any comment,” a spokesperson said. “As always, Liberty Vote is committed to advancing the future of secure American elections.”

No evidence of vote tampering

Looking at the systems headed into the midterms, Gulati said, “I do know that as of now, the state that we have described is going to be pretty similar to what will be deployed in November.”

Despite the extensive findings, Gulati repeatedly returned to what the researchers did not establish: “We found extensive and largely unacceptable weaknesses,” he said in the presentation. “But we did not find evidence that those weaknesses were actively exploited or that votes were altered.”

That distinction has drawn renewed attention as Trump and his allies again focus on election matters.

Last month, the president used a prime-time White House address to release newly declassified intelligence he said showed China interfered in the 2020 election. Among several disclosures, Trump pointed to intelligence showing Beijing had acquired personal information on roughly 220 million American voters. But the documents did not show China altered votes or gained the ability to manipulate voting systems.

Gulati echoed those conclusions Friday when asked about the declassification.

“The China thing isn’t really much of anything,” he said, arguing that a large amount of the voter information at issue could be obtained commercially and should not be confused with access to election systems in ways that can manipulate votes.

“There is no evidence that I know of that says China successfully or any other country has successfully infiltrated our systems and manipulated votes in any way,” he added.

Wareham called the 100-page document a preliminary report and said the firm had wanted another six months to a year to dig deeper into the underlying data.

Gulati said the company’s interactions with the ODNI employees overseeing that work were markedly different from the political pressure the researchers later encountered. “We were never pressured to put anything in our reports that was untrue or politically leaning in a certain way,” he said of those officials.

Wareham said Friday that Mojave itself has pushed for its report to be made public for roughly a year and has recently been told it could soon emerge through a Freedom of Information Act request. Nextgov/FCW could not immediately determine the origin of the FOIA requester. As of publishing time, ODNI’s FOIA logs are available up until January 2025.

“I’m a little annoyed that we are very close to midterms and we had a whole year to freaking figure this out,” Wareham said.

With their government work scrapped, he announced at the Voting Village that he had filed paperwork to create the Machine Assurance Institute, seeking to bring together cybersecurity researchers and election technology companies to examine and independently verify voting infrastructure.

“We wanted to be the national security answer, and put to bed, finally, discussions about prior elections and/or accusations of voter fraud,” said Wareham. “Because, believe it or not, I find it fairly national security-destabilizing to constantly accuse each other of cheating.”

]]>

Senate confirms Adam Cassady to run State Department cyberspace bureau

David DiMolfetta — Fri, 07 Aug 2026 15:24:00 -0400

The Senate on Friday confirmed Adam Cassady as the new U.S. ambassador for cyber and digital policy, filling a high-profile role that had been vacant since the start of the second Trump administration.

Cassady, currently a senior official at the National Telecommunications and Information Administration, was approved in a 51-47 vote as part of a package of some 70 nominees.

The Bureau of Cyberspace and Digital Policy, which traditionally is led by the person named to the position he was just confirmed for, has undergone significant workforce changes. A reorganization last year saw the bureau divided into three separate entities, including a new Bureau of Emerging Threats, and a reduction in overall staff.

The cyber bureau has mainly focused on international diplomacy for U.S. cyberspace, telecommunications and emerging technologies, and has sought to counter authoritarian tech practices. It was formally launched in 2022 under then-president Joe Biden. Cassady’s purview is not entirely clear under the new organizational structure imposed over the last year.

Under the Biden administration, the unit was headed by retired U.S. Marine Corps officer and technology executive Nate Fick, who used his position to take firm stances against Chinese officials when addressing Beijing-backed cyber intrusions into U.S. critical infrastructure.

During his April confirmation hearing, Cassady emphasized a need for international collaboration on secure and resilient digital systems. He also sidestepped giving a definitive stance on the export of advanced semiconductor chips to China, saying he would “very, very quickly develop” a position on the issue.

“As NTIA’s Deputy Administrator, Adam was critical to many of the agency's most significant achievements in advancing America’s technology leadership and protecting our interests abroad,” NTIA head Arielle Roth said in a statement. “His experience makes him exceptionally well-suited to represent America’s strength on the world stage.”

]]>