Defensive CYBER - Software Prototype Development

The Defensive CYBER - Software Prototype Development program (PE 0608041A) is a key Army initiative under the Research, Development, Test & Evaluation (RDT&E) appropriation, focused on advancing defensive cyber operations (DCO) capabilities. The program's primary objective is to develop, prototype, and modernize software and digital tools that enable the Army to deter, detect, and defeat cyberspace threats, while protecting critical assets and infrastructure. This line item supports a broad set of organizations including Army Cyber Command (ARCYBER), Information Warfare Operations Center (IWOC), Army Forces Command (FORSCOM), Regional Cyber Centers (RCCs), Cyber Warfare Battalion (CWB), Multi-Domain Task Force (MDTF), Cyber Protection Brigade (CPB), and Cyber Protection Teams (CPTs). Funding supports a range of capabilities and is executed primarily by the Program Executive Office - Intelligence, Electronic Warfare and Sensors (PEO IEW&S).

Defensive Cyber Operations - Cyber Analytics aims to deliver scalable, cloud-hosted big data platforms that provide data indexing, visualization, and analytics tools to cyber defenders at all echelons. Funding supports agile iterative releases, modernization of these platforms, integration with the Joint Cyber Warfighting Architecture (JCWA) Common Runtime Stack - Data (JCRS-D), and expanded use of artificial intelligence/machine learning (AI/ML) for enhanced threat detection. These efforts are designed to facilitate cyber counter-reconnaissance and enable defenders to discover sophisticated threats and vulnerabilities across Army networks.

Defensive Cyber Operations - Tools Suite provides a dynamic suite of software-based warfighting tools for Cyber Protection Teams, Regional Cyber Centers, and local defenders. Funding continues modernization of fielded Deployable DCO System Kits and Garrison DCO Platform systems, supporting updates to operating systems, security information and event management (SIEM), network mapping, and integration of new tools for endpoint security and threat intelligence. The goal is to ensure these platforms remain operational and responsive to evolving adversarial threats through continuous software upgrades and professional support services.

Defensive Cyber Operations - User Activity Monitoring (UAM) is the Army's flagship insider threat detection capability. Funding expands UAM deployment across classified networks and enhances AI/ML-driven user entity behavior analytics for predictive modeling and automated anomaly detection. UAM modules collect data for centralized analysis at the Insider Threat Hub, enabling rapid identification and mitigation of insider risks. Agile development practices support frequent releases and integration with other DCO tools and big data platforms, strengthening the Army's ability to respond to insider threats.

Defensive Cyber Operations - Forensics and Malware Analysis (F&MA) supports both remote and local forensic investigations and dynamic malware analysis. Resources fund modernization, license renewals, maintenance, and pilot testing of emerging technologies. These capabilities allow defenders to collect and analyze evidence from electronic devices, triage incidents, and restore affected systems quickly. The program's objective is to maintain up-to-date forensic and malware analysis tools that can adapt to new threat vectors and support global cyber defense operations.

Defensive Cyber Operations - DCO Development Environment (DCODE) provides centralized lifecycle management for integration, assessment, and optimization of DCO software and hardware assets. Funding supports program management, testing, system engineering, and integration of over fifty DCO tools, ensuring interoperability and security accreditation. The DCODE environment enables Cyber Protection Teams to securely access multiple networks and supports continuous modernization and standardization of cyber defense solutions.

Additional funding supports Garrison DCO Platform procurement and modernization, including integration with Installation Support Nodes to enhance data capture and analytical capacity. The Deployable DCO System receives operational support for fielded systems, while Management Services funds ongoing program management and acquisition support for multiple DCO programs. The ARCYBER Rapid Cyber Prototyping initiative enables rapid identification, prototyping, and assessment of novel cyber technologies in collaboration with industry and academia. These efforts are designed to provide the Army with agile, scalable, and effective cyber defense capabilities that can adapt to rapidly changing threat environments and operational requirements.