Printed from https://fiscalreceipts.com/program/0608041A/ — data as of July 28, 2026. Every figure is citation-backed; see the page online for per-number provenance.
Defensive CYBER - Software Prototype Development
Budget Figures
FY2026 award data is a partial year — USASpending awards are reported on a rolling basis and the fiscal year does not close until September 30. why partial FY2026 data? →
- FY24
- $104.0M
- FY25
- $74.5M
- FY26
- $89.2M
● actuals (line) · ○ enacted · ◇ request — gaps are editions the program is absent from, never interpolated.
| Series | FY19 | FY20 | FY21 | FY22 | FY23 | FY24 | FY25 | FY26 |
|---|---|---|---|---|---|---|---|---|
| Actuals | $0 | $0 | $56.7M | $108.0M | $92.5M | $104.0M | ||
| Enacted | – | $0 | $56.7M | $108.8M | $94.8M | $83.6M | $74.5M | |
| Request | – | – | $46.4M | $118.8M | $94.9M | $83.6M | $74.5M | $89.2M |
blank = series not published for this year; – = absent from that edition.
Asked vs spent: the PB2024 book requested $83.6M for FY2024; the PB2026 book reports $104.0M actually spent — $20.5M above the request.
Program Lineage
No predecessor/successor lineage was recorded for this program element — no FY-to-FY transfer into or out of this line was stated in the ingested J-books, and none was inferred from the program structure.
Description
Mission — Defensive CYBER - Software Prototype Development
- Defensive Cyber Operations (DCO) programs are key elements of the DCO Maneuver Baseline infrastructure, platform, and tools. The employment of defensive capabilities achieves the following objectives: deter, destroy and defeat cyberspace threats; gain time; economy of force; control key terrain; protect tasked critical assets and infrastructure; and develop intelligence. DCO consists of platform and software programs which are key elements of the DCO Maneuver Baseline infrastructure, platform, and tools. DCO supports the Army Cyber Command (ARCYBER), Information Warfare Operations Center (IWOC), Army Forces Command (FORSCOM), five (5) Regional Cyber Centers (RCCs), Cyber Warfare Battalion (CWB), Multi-Domain Task Force (MDTF), Cyber Protection Brigade (CPB), and twenty-one (21) Cyber Protection Teams (CPTs) in COMPO 1/2/3. Fiscal Year (FY) 2026 funding in the amount of $88.393 million supports Cyber Analytics (CA), Tools Suite, User Activity Monitoring (UAM), Forensics and Malware Analysis (F&MA), DCO Development Environment (DCODE), Garrison DCO Platform (GDP), and Deployable DCO System (DDS) capabilities. Funding will be executed by Program Executive Office - Intelligence, Electronic Warfare and Sensors (PEO IEW&S). - Army Cyber Command (ARCYBER) Rapid Cyber Prototyping (RCP) provides software-based capabilities that can quickly respond to emerging cyber threats and keep up with threat technology, while supporting multi-Domain operations. ARCYBER identifies potential development and prototyping efforts via Cyber Needs Forms (CNFs) based on operational feedback, changes in the operational information environment and/or trends of adversarial activity, which drive concept of operation (CONOP) and Tactics Techniques and Procedures (TTPs) modifications. These are separate and distinct from DCO programmed efforts already funded or budgeted for by Project Manager (PM) DCO and are used to rapidly address a network threat/vulnerability. FY 2026 funding in the amount of $0.845 million will be executed by ARCYBER. The FY 2026 request was reduced by $0.455 million for Advisory and Assistance Services to promote efficiencies and advance the policies of the Administration in alignment with Executive Order 14222, "Implementing the President's Department of Government Efficiency Cost Efficiency Initiative."
Mission — Defensive Cyber - Software Prototype Devel
- Defensive Cyber Operations (DCO) programs are key elements of the DCO Maneuver Baseline infrastructure, platform, and tools. The employment of defensive capabilities achieves the following objectives: deter, destroy and defeat cyberspace threats; gain time; economy of force; control key terrain; protect tasked critical assets and infrastructure; and develop intelligence. DCO consists of platform and software programs which are key elements of the DCO Maneuver Baseline infrastructure, platform, and tools. DCO supports the Army Cyber Command (ARCYBER), Information Warfare Operations Center (IWOC), Army Forces Command (FORSCOM), five (5) Regional Cyber Centers (RCCs), Cyber Warfare Battalion (CWB), Multi-Domain Task Force (MDTF), Cyber Protection Brigade (CPB), and twenty-one (21) Cyber Protection Teams (CPTs) in COMPO 1/2/3. Fiscal Year (FY) 2026 funding in the amount of $88.393 million supports Cyber Analytics (CA), Tools Suite, User Activity Monitoring (UAM), Forensics and Malware Analysis (F&MA), DCO Development Environment (DCODE), Garrison DCO Platform (GDP), and Deployable DCO System (DDS) capabilities. Funding will be executed by Program Executive Office - Intelligence, Electronic Warfare and Sensors (PEO IEW&S). - Army Cyber Command (ARCYBER) Rapid Cyber Prototyping (RCP) provides software-based capabilities that can quickly respond to emerging cyber threats and keep up with threat technology, while supporting multi-Domain operations. ARCYBER identifies potential development and prototyping efforts via Cyber Needs Forms (CNFs) based on operational feedback, changes in the operational information environment and/or trends of adversarial activity, which drive concept of operation (CONOP) and Tactics Techniques and Procedures (TTPs) modifications. These are separate and distinct from DCO programmed efforts already funded or budgeted for by Project Manager (PM) DCO and are used to rapidly address a network threat/vulnerability. FY 2026 funding in the amount of $0.845 million will be executed by ARCYBER.
Justification
Accomplishments & Planned Programs (9)
Defensive Cyber Operations (DCO) - Deployable DCO System (PEO EIS)
Deployable DCO System - Modular (DDS-M) is a multi-configurable air transportable deployable kit supports DCO deployed missions. DDS-M has the hardware/software capability that serves as primary weapon system for our Army's Cyber Protection Teams (CPTs) to conduct the DCO mission on the Department of Defense Information Network (DoDIN).
Defensive Cyber Operations (DCO) - Tools Suite (PEO EIS)
DCO Tools Suite is a flexible and dynamic software-based suite of warfighting capabilities that enables Cyber Protection Teams (CPTs), Regional Cyber Centers (RCCs), and in some cases local defenders to perform DCO and cybersecurity actions. DCO tools are constantly evolving and tailored to address current and emerging adversarial cyber threats. They are executed or managed within a DCO platform.
Defensive Cyber Operations (DCO) - User Activity Monitoring (PEO EIS)
DCO UAM is the flagship capability within the Army's Insider Threat program, delivered using agile product development methods. This scalable solution supports both on premise and cloud deployments and continuously monitors user entity behavior to identify potential insider threats. Using an agile backlog structured into strategic epics and supported by continuous integration/continuous delivery (CI/CD) practices, UAM proactively detects and mitigates risks associated with the theft or misuse of mission essential data. Data collected by distributed UAM modules is funneled into a centralized Insider Threat Hub for real time analysis and rapid action.
Defensive Cyber Operations (DCO) - Management Services (PEO EIS)
Funding provides program management services and support from a mix of government matrix and contractors that perform mission critical implementation, fielding, system engineering, logistics, programmatic, and acquisition support for nine ACAT IV programs in various phases of development and production.
Defensive Cyber Operations - Cyber Analytics (PEO EIS)
DCO Cyberspace Analytics Big Data Platform (BDP) is a scalable software-based, hardware agnostic capability hosted in the cloud, called Gabriel Nimbus (GN). GN provides data indexing, user interfaces, and visualization tools accessible to cyberspace defenders at all echelons to facilitate cyber counter-reconnaissance activities meant to discover the presence of advanced or sophisticated cyber threats and vulnerabilities.
Defensive Cyber Operations (DCO) - DCO Development Environment (Forge/Armory) (PEO EIS)
DCO Development Environment (DCODE) (Forge/Armory) are both physical and virtual assets that provide continual integration, upgrade, assessment, optimization in support of the warfighter's operational environment. Purpose is to provide centralized lifecycle management and consist of the following capabilities: 1) physical and/or virtual assets that provide integration and assessment capabilities during the development and integration phases of operations. These assets are centrally managed in order to provide accountability, modernization, standardization, software updating and patching and security posture in order to maintain the Authority to Operate (ATO); 2) provide the capability for Cyber Protection Teams (CPTs) to remotely access multiple networks, simultaneously, thru a safe and secure infrastructure framework.
Defensive Cyber Operations (DCO) - Garrison DCO Platform - Next Generation (PEO EIS)
The Garrison DCO Platform (GDP) is a system that provides the Army's cyberspace defenders with the capability to defend garrison network environments from a remote location. It ingests data via Test Access Points (TAPs), enables the employment of the software tools necessary to compute and analyze the data, and offers a storage and forwarding capability to ensure necessary data is retained locally or easily accessible via the Big Data Platform (BDP).
Defensive Cyber Operations (DCO) - Rapid Cyber Prototyping (ARCYBER)
ARCYBER Rapid Cyber Prototyping program provides the ability to very quickly identify, prototype, pilot, and assess cutting-edge non-program-of-record cyber-operations peculiar technologies and capabilities against ARCYBER's realistic environments and data to tailor capabilities and prototypes to ARCYBER's needs.
Defensive Cyber Operations (DCO) - Forensics and Malware Analysis (PEO EIS)
DCO Forensics and Malware Analysis (F&MA) capability is a software/hardware based solution enabling global, regional, and local cyberspace defenders to perform forensics either remotely or locally. Forensics is evidence related and Malware capabilities provides a sandbox like, virtual environment that allows for the conduct of real-time, automated and dynamic malware decomposition and behavior analysis. Forensics gives cyberspace defenders the ability to collect, process, search, and analyze evidence from portable electronic devices, removable media, system hard drives, and random access memory. This process rapidly triages an incident and place the impacted system(s) back in service.
Budget Line Items(workbook-cited)
Exhibit R-1
| Account | Org | Type | Amount |
|---|---|---|---|
| Research, Development, Test and Evaluation, Army | A | FY24 Actuals | $104.0M |
| Research, Development, Test and Evaluation, Army | A | FY25 Enacted | $74.5M |
| Research, Development, Test and Evaluation, Army | A | FY25 Total | $74.5M |
| Research, Development, Test and Evaluation, Army | A | FY26 Disc. Request | $89.2M |
| Research, Development, Test and Evaluation, Army | A | FY26 Total | $89.2M |
Budget Details(R-2/P-40 facts)
| Project | FY24 Actuals | FY25 Total | FY26 Base | FY26 Request |
|---|---|---|---|---|
| CD1: Defensive Cyber - Software Prototype Devel | $104.0M | $74.5M | $89.2M | $89.2M |
| Program Element | $104.0M | $74.5M | $89.2M | $89.2M |
No follow-the-dollar view — this program's awards haven't been crosswalked at high confidence (flows cover 17 of 1741 programs). why coverage is partial? →
Awards
No awards are linked to this program element at high confidence — the budget→award crosswalk only asserts links it can defend, and this line has none yet.
Lobbying Mentions
No Senate LDA lobbying filing in the tracked data mentions this program element by code or alias.
No research dossier for this program — dossiers cover 50 of 1741 programs, the largest fully J-book-detailed lines by FY2026 requested dollars. why no dossier here? →