Six big vendors dominate a fragmented federal cyber market, numbers show

Federal procurement of cybersecurity goods and services is highly fragmented, according to new research published this week, but despite this long tail of small awards, the market space is dominated by a handful of familiar names.

Federal procurement of cybersecurity goods and services is highly fragmented, according to new research published this week, with more than 7,600 different companies winning U.S. government contracts during the past six years. But despite this long tail of small awards, the market space is dominated by a handful of familiar names.

Only six contractors — Leidos, Northrup Grumman, Booz Allen Hamilton, IBM, Hewlett Packard and General Dynamics — earned a billion dollars or more in cyber contracts from the U.S. government in fiscal 2011-16, according to the new report from Govini, a consultancy that crunches procurement numbers.

A handful more — Dell, SAIC, CSRA, CACI, Lockheed Martin, Harris and Raytheon — earned hundreds of millions from the $45.9 billion obligated between 2011-2016 in three categories of federal cybersecurity spending: defense, resilience and threat analytics.

“Acquisition of cybersecurity solutions is highly fragmented now,” Arun Sankaran, Govini’s director of professional services and the report’s lead author told CyberScoop.

The report also shows that federal spending in those three categories rose significantly after 2013, from an average of $6.3 billion a year in 2011-2013, to around $9 billion a year 2014-2016.

Sankaran pointed out that 42 percent of that money — $19.3 billion overall — was spent via single, stand-alone contracts, with only 58 percent going through large multi-award contract vehicles like the Department of Homeland Security’s Continuous Diagnostics and Monitoring program — which pays for the installation of cybersecurity tools on federal networks governmentwide — or the General Services Administration Schedule 70.

The long tail of small players and the heavy reliance on stand-alone contracts are “symptomatic of the fragmented federal procurement process” for cybersecurity, Sankaran said.

The money is “peanut butter spread across this whole myriad of of contractors,” he added, meaning agencies “are not leveraging” the additional purchasing power offered by multi-award contract vehicles.

The cause of that fragmentation? Sankaran said civilian federal agencies have seen cybersecurity as an IT issue and dealt with it ad hoc, rather than as a core issue of mission effectiveness. That means “Agencies tend to cluster around their preferred providers, and they use whatever contracting mechanism is convenient.”

Partly as a result, cybersecurity is also “a services play, rather than a technology play in the federal government right now,” he said, meaning that “the big-time systems integrators who can supply a lot of bodies through contracts to agencies tend to dominate the market.”

Also telling for Sankaran: the high proportion of cybersecurity dollars spent on “operations and maintenance” or O&M — that is, keeping existing systems running as opposed to procurement of new technology or research and development.

“That tells me … a lot of how we’re defending networks now is we’re patching them, we’re maintaining and repairing the existing infrastructure that’s out there … Not a lot of what’s being spent on cyber today is [spent on] developing  the latest and greatest sophisticated technology… The bulk of the market is developing patchwork solutions for old networks through O&M,” he said.

He applauded the new administration’s apparent decision to emphasize IT modernization, shared services and enterprise-level risk management as the key to securing federal networks.

“If that gains momentum,” Sankaran predicted, “You’ll see an expansion in DHS’ role as leading efforts to make civilian government networks secure.” That in turn would lead to more larger, multi-award contract vehicles and “more consolidation of acquisition as DHS anoints certain companies.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure