Leidos secures $160m US Cyber Command award

Leidos has secured a five-year award worth $160 million to support US Cyber Command, providing cyber defence, operational planning, threat analysis and coordination services for military activities conducted across digital networks.

The award was announced on 21 October 2026 and includes operational support to secure, operate and defend the Department of War Information Network. Leidos will also support the integration and coordination of offensive and defensive cyber operations involving US Cyber Command and its mission partners.

The contract covers several related functions rather than the delivery of one named cybersecurity product. These include technical support for network protection, the assessment of emerging threats and the development of tactics, techniques and procedures used by military cyber personnel.

US Cyber Command operates within a digital environment that connects systems supporting communications, intelligence, administration, planning and other military functions. Protecting those connections requires an understanding of the infrastructure itself and the processes that depend on it, as well as the individual software applications and devices involved.

Network defence begins with reliable information about the systems being protected. Operators need to understand which devices and services are present, how they communicate and which dependencies are important to continued operation. An incomplete inventory can make it difficult to establish the extent of an incident or identify equipment requiring urgent attention.

Security monitoring provides information about activity across that infrastructure. Relevant observations may come from communications equipment, endpoint security tools, identity systems and other sources that record events associated with users, applications and network traffic.

Those sources produce different kinds of information and may use different formats or timing references. To establish whether events are connected, analysts must correlate observations and assess them against the expected operation of the systems involved.

A single unusual event does not necessarily establish that an intrusion has occurred. Legitimate maintenance work, changes in network configuration and ordinary user activity can generate alerts, while some hostile behaviour may resemble permitted operations until further evidence becomes available.

Investigations therefore depend on the quality of the collected records and the ability to distinguish technical observations from assumptions about their cause. Where malicious activity is confirmed, personnel must understand which systems are affected before selecting measures intended to contain or remediate the problem.

Such measures can themselves affect military operations. Isolating a system may limit further compromise but also interrupt a service on which other activities depend. Cyber defence consequently requires coordination between technical specialists and the organisations responsible for operating the affected infrastructure.

The US Cyber Command award includes emerging threat analysis, which supports the assessment of new techniques, vulnerabilities and patterns of hostile activity. Such work can help identify where existing protections may be insufficient and which systems require further investigation or changes to their security configuration.

Threat information must be evaluated in its technical context. An indicator associated with one incident may be relevant to other environments, but its presence alone does not establish that the same actor or activity is involved. Reliable analysis draws on several sources and recognises the limitations of available evidence.

Operational planning forms another component of the contract. Military cyber activities involve defined objectives, responsibilities and authorities, with plans required to account for technical resources and the interaction between separate organisational functions.

Where several teams are involved, the information required to coordinate their work must be shared through suitable channels. Differences in network access, security classification or technical procedures can affect the pace at which information is exchanged and interpreted.

The contract also covers coordination between offensive and defensive cyber operations. These functions have different objectives and authorisation arrangements, and the public disclosure does not identify particular operations, target systems or the activities that individual contractor personnel will perform.

Integration at command level can involve maintaining an accurate understanding of available capabilities and the relationship between separately planned activities. Support for that process should not be confused with independent authority for a contractor to initiate military operations.

Leidos will additionally help develop tactics, techniques and procedures. Documented operating methods provide personnel with a consistent basis for handling recurring activities, recording responsibilities and incorporating lessons from earlier exercises or incidents.

Those procedures require regular examination because network equipment, software versions and threat behaviour change. A process suitable for one technical configuration may no longer work as intended after significant alterations to the environment.

Training and validation help establish whether personnel can apply procedures using the systems available to them. A realistic test must also account for interruptions, incomplete information and the possibility that equipment behaves differently from its nominal specification.

Leidos says its delivery team will draw on specialist capabilities from across its cyber business, including recently acquired Kudu Dynamics. The company has not assigned public work packages to individual units or identified the precise tools that will be used under the award.

Combining technical teams within a common support arrangement requires consistent engineering and security practices. Work products, findings and configuration records must be handled under the controls appropriate to the systems involved, while changes made during support activities need to be documented and verified.

The $160 million figure represents the announced value of the five-year award. It has not been broken down into annual allocations, individual task values or spending commitments for particular technical systems, and the public material does not identify the number of personnel assigned.

Leidos has an established role in defence technology, information systems and cybersecurity support. The new contract extends that work for US Cyber Command, but the announcement provides no evidence that specific new software products have been deployed or that an identified military cyber mission has been completed.

Future performance will be determined by the services provided under the command’s requirements, including the quality of technical analysis, planning support and coordination arrangements. The award establishes the contract’s duration and principal functions, while the detailed delivery activities remain outside the public disclosure.