Reach and Knox pursue DISA IL5 authorisation

Reach Security has partnered with Knox Systems to pursue Defense Information Systems Agency Impact Level 5 authorisation, seeking to make automated security-control assessment available within sensitive unclassified US defence computing environments.

The partnership was confirmed on 11 November 2026 and will use Knox’s dedicated federal cloud infrastructure to support Reach’s proposed entry into the defence market. The companies have not disclosed a contract value, implementation timetable, or confirmed government customer for the planned deployment.

Impact Level 5, commonly abbreviated to IL5, applies to cloud services handling controlled unclassified information and certain unclassified National Security Systems data. The requirements address the protection of information and computing services used in sensitive government operations.

The announcement establishes an intention to pursue authorisation, rather than confirmation that Reach has received it. The software company will still need to satisfy the applicable assessment and approval requirements before its proposed service can be treated as authorised for the relevant defence workloads.

Reach develops software for assessing and managing the security controls already deployed across an organisation’s information systems. Its platform examines configurations across technologies including identity management, endpoint protection, email security, firewalls, and Secure Access Service Edge infrastructure.

Large organisations frequently operate several defensive technologies with overlapping responsibilities. Individual products may enforce access restrictions, inspect network traffic, monitor endpoints, or protect communications, but the effectiveness of those controls depends on how their settings are configured and maintained.

Configuration changes can introduce differences between an organisation’s intended security policy and the protections actually operating. Temporary exceptions may remain active, permissions can become more extensive than required, and security functions may be present without being configured to provide the expected protection.

Reach’s software is intended to identify these weaknesses by examining available configuration information and assessing the controls against security policies and relevant exposure data. The platform can then prioritise areas requiring corrective action.

The company describes its technology as providing a central view of existing defensive capabilities. Rather than introducing a separate security product for every identified problem, it seeks to determine whether tools already installed within the organisation can be configured or coordinated to address the weakness.

Its software can support remediation and compensating controls through integrations with existing management systems. The extent of any automated changes depends on the functions supported by those integrations and the permissions granted within the customer’s environment.

Continuous assessment provides an approach to detecting configuration changes between periodic security reviews. It can identify settings that have moved away from an approved baseline, although its effectiveness depends on the completeness of the information collected and the quality of the rules used to evaluate it.

Knox Systems provides managed cloud infrastructure designed for federal government applications. In September 2026, the company announced a dedicated IL5 environment sponsored by the US Space Force, extending its existing government cloud services into a more tightly controlled category of defence workloads.

The environment is designed as a separate security boundary with isolation, monitoring, and operational controls appropriate to its intended applications. Knox describes this arrangement as a means of supporting commercial software companies seeking to serve government customers without constructing an entirely independent dedicated hosting environment.

Using an established infrastructure boundary can reduce some of the engineering and administrative work involved in preparing a new cloud service. However, the suitability of the hosting environment does not automatically establish that every application deployed within it satisfies the necessary security requirements.

Reach will still need to address the controls applicable to its own software, including access management, data processing, vulnerability handling, monitoring, and the operation of interfaces connecting it to other defensive technologies. The companies have not released the detailed architecture proposed for the installation.

Security-control management software can require broad visibility of an organisation’s technical environment. Information about access permissions, network arrangements, protection settings, and installed systems may itself be sensitive, making the handling of collected data an important consideration.

Connections to identity, endpoint, firewall, and other management platforms must also be controlled. Integrations intended to support remediation may require permissions to change security settings, creating a need for authorisation procedures, audit records, and safeguards against unintended modifications.

These functions must be considered alongside the requirements of the cloud infrastructure. A service may operate within a protected environment while still introducing risks through excessive permissions, unsuitable data flows, or incorrectly configured application interfaces.

Knox intends to provide the hosting and compliance infrastructure through which Reach pursues the necessary approval. Reach will contribute the software responsible for analysing security-control configurations and supporting corrective actions across the technologies connected to its platform.

The proposed arrangement is directed towards defence and government organisations seeking to manage complex security environments. It does not establish that the platform has already been approved for every category of sensitive information or that its remediation functions are authorised for operational military networks.

Garrett Hamilton, chief executive and co-founder of Reach Security, has positioned the partnership around accelerating defensive responses using security products organisations already own. Knox chief executive Irina Denisenko has emphasised the need for continuous confirmation that deployed controls remain aligned with their intended policies.

The companies have not published completed authorisation assessments, a formal approval decision, or an operational implementation schedule. Their announcement therefore represents a step towards making Reach’s software available through a defence-oriented cloud environment rather than confirmation of an approved service.

Further progress will depend on the assessment of the proposed deployment, the controls governing its integrations, and the requirements of prospective government customers. A completed DISA IL5 authorisation would establish an important eligibility milestone, but it would remain separate from any subsequent procurement or operational deployment decision.