Army’s Project Gatekeeper aims to cut software approval times from months to ‘minutes’

WASHINGTON — In just ten days, the Army will activate Project Gatekeeper, a new AI-enhanced cybersecurity sandbox designed to vet commercial software for use on Army networks, officials announced today.

Launching Oct. 23, Project Gatekeeper is creating a single sandboxed environment — running on the Army’s cloud but isolated from operational networks and sensitive data — where companies can bring their software for assessment, even if they don’t have an Army contract or a program manager to sponsor them. Officials say Gatekeeper will cut the time required to get software approved from months to “minutes” — without sacrificing security in the process.

“Success, to me, looks like a company, within minutes, is able to log in, submit their code and get the green check mark from our pipeline that says you are good to go,” acting Army Chief Information Officer Gabe Chiulli told reporters at the annual AUSA conference here this morning.

Compare that with the current, cumbersome clearance process that can take days or weeks — stalling some software projects for as long as nine months, Chiulli and other officials said. That’s a long time to wait for a software upgrade, especially under a process that officials say lack consistent cybersecurity practices, transparency for contractors and visibility for Army leaders into what’s actually happening on their networks.

“We have had to do a lot of weird janky things to get code into our environments,” Chiulli said. Sometimes, he said, “I’m not sure how they’re getting code over to us.”

The root of the problem, officials said, is that the Army has lacked a single, standardized, centralized process for bringing commercial software onto its secure networks. Instead, “it was up to every program manager,” explained David Markowitz, the service’s chief data and analytics officer.

But many program offices lacked the capability or willingness to conduct cybersecurity assessments of new and unfamiliar code. Rather than evaluate the software themselves, they would wait for another organization to vet the company and officially grant its software Authority To Operate (ATO) on military networks.

“A lot of times, organizations in the Army won’t talk to [companies] until they have this ‘golden ATO,’” Chiulli said.

That created a kind of Catch-22: The companies best positioned to win Army software contracts where often the ones that already had them. Meanwhile new, innovative entrants — the kind of companies that the Pentagon’s been courting for over a decade — struggled to navigate the combined complexities of cybersecurity rules, procurement regulations and Army bureaucracy.

If a program manager did decide to give a new piece of software a chance, moreover, they rarely had a dedicated, isolated sandbox in which to test it. Instead, they had to bring it onto an Army network and assess it there. That, in turn, required the company’s personnel to get cleared for Common Access Cards (CAC) so they could access the Army system.

“We spent a lot of time and energy trying to get people CAC cards simply to help work with us,” Chiulli said. “This is to get rid of all that [and] lower barriers to entry.”

Gatekeeper will let companies test their software before they have an Army contract, a program manager sponsoring them or even a formal request for proposals to respond to, the officials emphasized, allowing prospective vendors to identify and address cybersecurity problems before trying to do business with the service.

Companies will still need CAC cards to access the platform initially, officials acknowledged. But the Army is finalizing an agreement with the General Services Administration (GSA) to use its Login.gov platform, which allows secure access to government systems for members of the public.

“We’re looking at mid-November to have that integrated, at which point we’ll be able to make this actually commercially accessible,” said David Wright, chief engineer at the Army Software and Innovation Center (ASIC).

Once a company gets access to the Gatekeeper platform, it can upload its software and run it through the Army’s standardized cybersecurity tools, including an AI assessment, officials explained. In minutes, the automated system will either tell the company its software passed the test or give detailed, actionable feedback explaining why it failed.

Gatekeeper will also include the Army’s DevSecOps software development kit, Wright said, giving companies a secure environment in which to address problems using tools the Army itself has vetted.

“The idea here is not to lessen the security requirements,” Wright emphasized, “but more to make the process more accessible and available, so that they can get immediate feedback and understand what it is that needs to be adjusted or corrected before these things are brought into an Army environment.”