“Success, to me, looks like a company, within minutes, is able to log in, submit their code and get the green check mark from our pipeline that says you are good to go,” acting Army Chief Information Officer Gabe Chiulli told reporters at the annual AUSA conference this morning.
Project Gatekeeper launches Oct. 23
The Army will activate Project Gatekeeper on Oct. 23, officials announced, creating a single, sandboxed environment hosted on the Army’s cloud but isolated from operational networks and sensitive data. The platform is intended to let companies bring commercial software for assessment even if they lack an Army contract or a program manager sponsor. Officials say the system is designed to sharply reduce the time required to approve software — from months to what they describe as “minutes” — while preserving security controls.
How the sandbox and AI assessment operate
Once a company gains access to Gatekeeper, it can upload software and run it through a standardized suite of Army cybersecurity tools. Officials described an automated pipeline that includes an “AI assessment” and will either produce an immediate pass or provide “detailed, actionable feedback” explaining why a submission failed. The platform will also include the Army’s DevSecOps software development kit, giving companies a secure environment in which to remediate findings using tools the Army has already vetted.
David Wright, chief engineer at the Army Software and Innovation Center (ASIC), emphasized that the goal is not to lower security standards but to make the process “more accessible and available,” so companies receive immediate feedback and can correct issues before attempting to introduce code into Army environments.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAccess controls, CAC cards, and Login.gov integration
Officials said companies will still need Common Access Cards (CAC) to access the platform initially. The Army is, however, finalizing an agreement with the General Services Administration (GSA) to use its Login.gov platform for public-facing secure access. Wright said the Army is “looking at mid-November to have that integrated,” at which point Gatekeeper would become commercially accessible without the upfront CAC requirement.
Why the Army says Gatekeeper is needed
Officials framed Gatekeeper as a remedy to a fragmented, inconsistent process that has slowed software updates and limited transparency. Chiulli described existing practices as “cumbersome,” noting some projects can be stalled for “as long as nine months.” David Markowitz, the service’s chief data and analytics officer, said the Army lacked a single, standardized, centralized process for bringing commercial software onto secure networks and that responsibility had fallen to “every program manager.”
That decentralized model produced uneven cybersecurity practices and limited visibility for Army leaders. Markowitz and Chiulli said many program offices lacked either the capability or willingness to perform cybersecurity assessments on unfamiliar code; instead, units often waited for another organization to vet a company and grant a formal Authority To Operate (ATO). Chiulli described a Catch-22 in which companies likely to win contracts were often those that already had ATOs, while newer entrants struggled to obtain the needed approvals.
Gatekeeper is intended to break that loop by giving prospective vendors a place to test and fix software before a program manager must decide whether to bring the code into an Army environment. Chiulli said the new approach will remove the need to clear outside personnel for CAC cards just to work with Army systems, reducing what he termed “weird janky things” the service had previously used to move code into its environments.
What this means for companies, program managers, and engineers
- Companies and prospective vendors: Gatekeeper lets firms assess and remediate cybersecurity issues before pursuing contracts or sponsorship, enabling them to submit software for Army use without first holding a contract or ATO. The automated pipeline promises immediate pass/fail results and actionable feedback.
- Army program managers: The sandbox offers a standardized testing environment they can rely on rather than building ad hoc processes or requiring other organizations’ ATOs. The platform aims to increase transparency and reduce the burden of vetting unfamiliar code within operational networks.
- Army engineers and ASIC: With the DevSecOps software development kit integrated into the sandbox, engineering teams will be able to apply vetted tools to correct failures inside a secure, isolated environment using the Army’s established toolchain.
Project Gatekeeper’s launch on Oct. 23 and the planned Login.gov integration in mid-November set a tight timetable. Officials have framed Gatekeeper as a structural fix to a process they describe as slow and uneven; the coming weeks will be the first test of whether an Army-hosted, AI-enhanced sandbox can deliver the minutes‑long approvals its leaders promise.
