FCN Wins $30 Million Air Force Cortex XSOAR Sustainment Contract

FCN Inc. of Rockville, Maryland, has received a $29.7 million firm-fixed-price contract from the Air Force Life Cycle Management Center to renew sustainment of the Palo Alto Cortex Extended Security Orchestration, Automation, and Response (XSOAR) platform. The award covers platform and intelligence-management licenses, subscriptions and dedicated expertise. Work will take place at locations inside and outside the continental United States and is expected to be completed by Sept. 29, 2028.

Palo Alto Cortex XSOAR Sustainment Details

FCN will provide the licenses, subscriptions and dedicated expertise needed to sustain the Air Force’s existing XSOAR platform. The award notice identifies a renewal of the platform and its intelligence-management capabilities, rather than the purchase of a new system. Earlier FCN XSOAR work included software support for upgrades and operation within Air Force network operations infrastructure, including integration with the Cyberspace Vulnerability Assessment/Hunter (CVA/H) weapon system and Integrated Defensive Cyberspace Systems (IDCS).

The Air Force’s recent SOAR market-research responses describe the existing capability as a cloud platform within IDCS. They identify Elastic security-event and endpoint tools, Air Force identity management, threat-intelligence feeds and Tanium endpoint actions among the systems relevant to SOAR integration. Those responses provide operational context for the renewal; the award notice does not assign specific new integrations or tactical deployments to FCN under this contract.

Award and Contractor Background

The Air Force awarded the contract on Sept. 30, 2026, through a competitive acquisition under the Department of War Enterprise Software Initiative using NASA’s Solutions for Enterprise-Wide Procurement vehicle. FCN also received a $11.3 million XSOAR order covering licenses, consultation and technical support through September 2025, followed by a $11 million annual renewal through September 2026. The earlier orders supported Air Force defensive cyber systems, including CVA/H and IDCS.

Separately, the Air Force Life Cycle Management Center conducted market research on a next-generation SOAR capability in September 2026. Its technical request for information used Cortex XSOAR as a capability benchmark while seeking feedback on vendor-agnostic software for cloud, garrison and tactical-edge environments. That inquiry was for planning purposes; it did not announce a replacement for the platform covered by FCN’s renewal.

This award was disclosed by the DoW in its daily press release. Additional contract details will be available on HigherGov in approximately 90 days under FA830726FB099 after the contract is formally disclosed by the government.