Assessments and Evaluations Cyber Vulnerabilities

The Assessments and Evaluations Cyber Vulnerabilities program, funded under Army Program Element (PE) 0606942A, is designed to reduce the Army's risk to adversarial cyber intrusions or attacks that could compromise critical weapon systems, business systems, and operational kill chains. The primary objective is to enhance the survivability and resilience of Army modernization efforts by identifying, prioritizing, and remediating cyberspace vulnerabilities in accordance with Congressional mandates, such as Section 1502 of the FY24 National Defense Authorization Act (NDAA). This program addresses both current and emerging cyber threats by focusing on critical capabilities most relevant to the National Defense Strategy.

The central component of this program is the Cyberspace Operational-Resilience Assessment - Platform (CORA-P). CORA-P was established to fulfill Congressional requirements, initially under FY16 NDAA Section 1647 and now expanded under FY24 NDAA Section 1502. The program's goals include harmonizing the identification and mitigation of cyberspace vulnerabilities across critical Army weapon systems, integrating supply chain risk analysis, and addressing electromagnetic spectrum vulnerabilities. CORA-P has evolved from conducting new assessments to coordinating and harmonizing defensive efforts across existing Army and Department of Defense (DoD) assessment programs, such as the Strategic Cybersecurity Program.

A key objective of CORA-P is to shift the Army's approach from system-oriented compliance to a system-of-systems resilience model. This model addresses defensive gaps between individual components, thereby preventing adversaries from exploiting seams in Army kill chains. The program emphasizes the development and delivery of remediation strategies based on assessment findings, sensitive threat intelligence, and other indicators of compromise. By improving the structure and visibility of vulnerability data, CORA-P supports better portfolio risk management and enables the Army to initiate remediation efforts for high-priority, crosscutting issues.

In FY 2025, CORA-P funding will support the Army's digital transformation by automating cyber vulnerability collection, analysis, and reporting. This automation is intended to enhance the efficiency and effectiveness of identifying risks such as compromised software, insecure configurations, and supply chain vulnerabilities. The program will also develop specific remediation plans for priority findings, including those from the DoD Security Cooperation Program, and deliver fixes at mission-relevant speeds. These efforts are coordinated with Army Cyber Command and other stakeholders to ensure a comprehensive understanding of risk exposure and to avoid duplication of effort.

For FY 2026, the Assistant Secretary of the Army for Acquisition, Logistics, and Technology (ASA(ALT)) will continue to address cyber vulnerability trends and deliver crosscutting remediations to ensure the resilience and survivability of weapon systems. This includes oversight of ongoing and new strategies resulting from Strategic Cybersecurity Program evaluations, as well as integrating compliance into readiness reporting through the Commander's Unit Status Report. The Army will also focus on improving the electronic and automated delivery of software updates to deployed weapon systems, further enhancing software readiness and accountability.

Another significant line item within this program is the Army Acquisition Red Team. In FY 2025, the Red Team provided capabilities to test emerging and evolving DoD and Army technologies against operationally realistic threats. The Red Team's objectives included developing adversary tactics, techniques, and procedures (TTPs), conducting broad assessments of science and technology environments, and supporting persistent cyber operations at the Combatant Command (COCOM) level. The Red Team also contributed to the protection of intellectual property and critical technology information, supporting Army modernization and the goals of the Army Campaign Plan for Army 2030.

The FY 2026 budget eliminates funding for the Red Team capability, reflecting a shift in program focus and a reduction in total funding for this line item. The change is justified by a transition away from new Red Team assessments toward harmonizing and remediating vulnerabilities identified through existing evaluations and sensitive threat intelligence. The Assessments and Evaluations Cyber Vulnerabilities program remains focused on ensuring that Army cyberspace remediation investments address areas of highest operational risk, supporting the Army's ability to maintain readiness and operational effectiveness in the face of evolving cyber threats.