The achievement is a major milestone for DISA’s Thunderdome initiative, which offers a suite of IT and cybersecurity technologies that various agencies across the Defense Department can use as their zero-trust solution. DISA’s validation of Thunderdome comes more than two years ahead of the Pentagon’s deadline to implement target levels of zero trust by the end of fiscal 2027.

“It is a stellar machine system and environment, and there’s a lot of DOD field activities and agencies that are depending on that solution as its [zero-trust] solution,” Resnick said Wednesday during the Defense Acquisition University’s annual Zero Trust Symposium.

Zero trust is a cybersecurity framework that assumes networks are already compromised by adversaries, as opposed to the perimeter-based standards traditionally employed by the DOD. Rather than establishing a protective cybersecurity boundary over its networks, zero trust requires the Pentagon to integrate new capabilities that can constantly monitor and authenticate its networks and users as they move through them.

The DOD’s 2022 Zero Trust Strategy outlined a minimum set of 91 capability outcomes that agencies and components must meet to achieve “target levels” of zero trust no later than Sept. 30, 2027. The strategy also provided an additional 61 activities that are required to meet what the Pentagon considers “advanced levels.”

Resnick said DISA’s Thunderdome achieved a “perfect 152 out of 152,” meaning the solution is the second to hit all of the department’s ZT capability outcomes. The Navy’s cloud-based Microsoft Office 365 platform — known as Flank Speed — was the first zero-trust solution to achieve advanced levels, and met all 152 requirements earlier this year.

“Thunderdome is the Defense Information Systems Agency’s (DISA) comprehensive ZT solution,” Chris Pymm, Thunderdome portfolio manager at DISA, told DefenseScoop in a statement. “Recently, the Department of Defense DOD CIO purple team has validated that Thunderdome provides advanced level ZT across all 152 activities in DOD’s ZT model. What’s more, organizations can leverage DISA’s Thunderdome procurement vehicle to meet their integration ZT needs.”

According to the agency, the Thunderdome solution leverages enterprise identity credential and access management (ICAM); commercial secure access service edge capabilities; and software-defined wide area networking and security tools.

In 2022, DISA awarded Booz Allen Hamilton a $6.8 million other transaction agreement to prototype Thunderdome, which was later extended to include the Pentagon’s classified Secure Internet Protocol Router Network (SIPRNet). Following 18 months of development, the company received a follow-on production contract in 2023 to transition the solution into full deployment. 

The award is structured as an indefinite delivery/indefinite quantity (IDIQ)-like award to allow for other Pentagon agencies and departments to leverage the OTA over a five-year period. The contract has a total ceiling of $1.86 billion.

Pymm said that Thunderdome “will complete the DISA terrain in June of this year.” The effort’s zero-trust capabilities will be scaled to defense agencies and field activities via the broader migration of users to its new modernized network, known as DODNet, he added.

In fiscal 2025, Thunderdome will be fielded to the Defense Contract Management Agency, Defense Contract Audit Agency, Defense Logistics Agencies, Defense Media Activity, Defense Finance Accounting Service and the Defense Microelectronics Activity.

Moving forward, DISA plans to deploy the capability to the following agencies and organizations in fiscal 2026: Defense Threat Reduction Agency, Joint Staff’s J-6 directorate, Defense Advanced Research Projects Agency, Missile Defense Agency and Defense Manpower Data Center.

Updated on April 2, 2025, at 5:25 PM: This story has been updated to include more information from DISA about plans for Thunderdome and statements from Chris Pymm, Thunderdome portfolio manager.

The post DISA’s Thunderdome achieves advanced zero-trust goals appeared first on DefenseScoop.

Pending accreditation, the chatbot will be deployed to U.S. Indo-Pacific Command and allow users to experiment with genAI models on the Secure Internet Protocol Router (SIPRNet), Jeff Marshall, director of DISA’s Hosting and Compute Center, said during a webinar broadcast Tuesday by Federal News Network. The platform is currently in the accreditation stage and is expected to open up “within the next month or so,” Marshall noted.

The capability was developed in close collaboration with the Air Force Research Lab, which launched its own experimental generative AI chatbot for the Department of the Air Force on unclassified networks — dubbed NIPRGPT — last year. Similar to AFRL’s program, AFRL and DISA are using the effort to evaluate and expedite delivery of commercial AI tools, but the agency’s initiative will be in classified realms, Marshall said.

“We’re not trying to deploy this on our own. We’re not trying to make it a production system. This is [a research-and-development] system that we’re using for Indo-Pacom in order to test large language models overseas,” he said.

Across the Pentagon, organizations have looked to capitalize on commercial large language models and other artificial intelligence capabilities. Although there have been various efforts over the last few years — ranging from task forces to experimental platforms — the department is still learning how the technology can be best used to improve back-office and tactical operations.

Marshall noted that DISA’s SIPR-based LLM will largely help “facilitate that demand signal of, what does an Indo-Pacom commander need and want to utilize AI for? And then, how do we then shape that to what industry can actually provide for us at scale?”

DISA plans to host the chatbot on one of the two Joint Operational Edge (JOE) cloud environments it has deployed to the Pacific. Initiated in 2023, the JOE cloud effort seeks to stand up commercial cloud environments at the agency’s overseas data centers, allowing DISA to place cloud-native applications in locations outside of the continental United States. Along with JOE, the agency is also providing its private cloud capability known as Stratus to areas overseas.

To date, DISA has put two JOE cloud nodes at Indo-Pacom and one at U.S. European Command, and will soon deploy another node in Southwest Asia, Marshall said.

Moving forward, DISA is looking to potentially provide additional JOE cloud environments in Europe in order to support operations for U.S. Africa Command, which is headquartered in Germany. But Marshall emphasized the agency is doing so while balancing demand signals with available resources.

“Let’s don’t just throw it all out there one time and hope that it sticks to the wall,” he said. “We’re taking in the demand signal, we’re making sure that there is a valid need that supports us doing the deployment and then, of course, there’s a budget to cover it.”

Updated on March 26, 2025, at 10:35 AM: This story has been updated to clarify AFRL’s role in the new chatbot initiative and to remove “acting” from Jeff Marshall’s job title.

The post DISA launching experimental cloud-based chatbot for Indo-Pacific Command appeared first on DefenseScoop.

In its so-called “Tech Watchlist” for fiscal 2024, DISA now has multiple items that cover specific capabilities and issues related to artificial intelligence — from leveraging large language models to what guardrails are needed when deploying AI. The new categories have been divided up from a single item that was dedicated to tracking overarching AI/ML technologies, according to Steve Wallace, DISA’s chief technology officer and director of emerging technologies.

The update comes as the Pentagon pushes for improved and responsible deployment of AI. Last week, the Department of Defense released its new Data, Analytics, and AI Adoption Strategy. For DISA, the specific areas will help inform how it leverages the technology in the future, Wallace said Monday while unveiling the new watchlist at DISA’s annual forecast to industry event.

“There is nothing more important than the ability to operate a system that you deliver. You could deliver the most spectacular, exquisite capability in the world, but if it is too hard to operate then you’ve really not done a whole lot because it’s likely down more than it is up,” he said. “So, how are we going to insert artificial intelligence into that chain?”

DISA’s watchlist — which is routinely updated at least every fiscal year, but oftentimes more frequently — is a broad inventory of over two dozen new technologies the agency has identified as ones it’s interested in pursuing. The items are divided by maturity levels, from technologies just being surveyed to actual prototypes that the agency is gearing up to deploy, such as the recently awarded Thunderdome zero-trust cybersecurity effort.

One new category in the “monitor” subdivision tackles AI operations and was born from conversations the agency is having with the Defense Innovation Unit (DIU) about a prototype it has in the works, Wallace said. The AI-enabled prototype is “taking log sets from given infrastructure components and given systems and then using a model to train itself over the course of weeks or months to do predictive analysis or predictive reliability analysis,” Wallace said.

DISA is hoping to learn some lessons from the prototype work in order to improve how it addresses vulnerabilities in the Defense Department’s networks by using artificial intelligence to predict them far in advance.

The agency has also added an item in the “monitor” subdivision of the watchlist that is dedicated to trust, risk and security management of artificial intelligence. Wallace noted that this category will explore how the Pentagon can keep pace with its adversaries’ use of AI, while also identifying technology guardrails DISA will need to implement.

Wallace pointed to some capabilities that act as a proxy for publicly available large language models as an area of concern. These tools will take in queries from users, run them against a contained dataset, and eventually pass them to public large language models such as OpenAI’s ChatGPT or Google’s Bard, he said.

Broadly, large language models are deep learning algorithms that are trained with massive datasets to recognize, summarize, translate, predict and generate convincing, conversational text and other forms of media in a manner that mimics a real human being.

“The department has a number of concerns against querying those commercial, large language models,” Wallace said. “How are we going to protect ourselves? How are we going to deal with that until such time that these models exist in a [government] cloud or higher environment?”

Despite the concerns, DISA hasn’t sworn off large language models as the fiscal 2024 technology watchlist renamed its generative AI category, added earlier in 2023, to “concierge AI.” The technology currently sits on the “planning” subdivision of the watchlist — meaning the agency has an understanding of how it could impact and integrate into missions.

“What we’re looking for out of a concierge AI … is the idea of having for the business side of the house that ChatGPT-like experience of being able to interact and ask questions of data sets,” Wallace said. “The other side of that coin that we sort of bundle under this, although it’s a slightly separate effort, is how are we helping the analysts. On the security platforms, how are you helping the analyst more quickly diagnose threats [and] put the pieces together far more quickly?”

It’s possible DISA will award an other transaction agreement for a prototype of the capability in fiscal 2024, he added.

Although the watchlist offers a snapshot of DISA’s technological endeavors, the agency does have a technical strategy in the works that will serve as a more specialized counterpart to DISA’s overall strategy, Wallace said. Although the strategy is still in its first draft, Wallace teased three main points it will cover: simplification of systems, integration across the agency and iterative delivery of new capabilities.

The post DISA’s updated tech watchlist gets specific on AI capabilities appeared first on DefenseScoop.