The U.S. Army is piloting an artificial intelligence (AI)-enabled software security platform designed to accelerate the process of bringing commercial software onto Defense Department (DOD) networks while improving risk visibility across the Army’s sprawling software environment.
Speaking at the Digital Transformation Summit on Sept. 22, Gabriele Chiulli, acting chief information officer (CIO) of the Army, described Project Gatekeeper as a bridge between commercial technology providers and the Pentagon’s cybersecurity and authorization requirements.
The project is designed as a “completely commercialized DevSecOps platform,” Chiulli said. Vendors would connect to Army-managed DevSecOps pipelines, use commercial frontier AI models to analyze their code, and generate evidence to support an Authority to Operate (ATO) decision.
The approach could reduce some of the technical and compliance work that slows software adoption while preserving the authority of government officials to make final risk decisions, Chiulli said.
Gatekeeper is intended to operate more like a commercial platform than a traditional government enclave, Chiulli said. Industry users would authenticate through Login.gov rather than relying on common access cards, bring their own API keys for frontier AI models, and use Army-built tools and automated pipelines.
Those pipelines would conduct deep code scans, apply security and compliance checks, and generate artifacts for ATO packages.
The platform would not replace the formal risk-acceptance role of authorizing officials. Instead, it is intended to automate and accelerate the technical work that informs their decisions.
Chiulli said the Army faces a particularly complex software environment spanning decades of development. Gatekeeper would use AI to analyze that code, assess risk against mission requirements, and improve visibility into software bills of materials.
The Army also wants the platform to provide a more consistent technical foundation for security assessments across legacy and newer systems.
For industry, access to the platform would not eliminate the need to establish demand for a product within the Army. Chiulli said vendors remain responsible for identifying the government users and missions that need their technology.
He encouraged companies to find a functional owner – such as a system owner, program office, or operational unit – rather than expecting the Army CIO’s office to identify customers or use cases.
Once a vendor has a willing mission sponsor, Army CIO teams can help integrate the technology into the security pipeline and move it toward authorization, Chiulli said.