We get this question from other small software firms about once a month: how do you actually get defense software work?
The honest answer is that almost nobody starts as a prime contractor. You start as a subcontractor, doing a well-defined piece of work for a prime or a funded defense startup that already has the contract. Here’s how that works, from our seat in San Antonio.
Prime or subcontractor?
A prime contractor holds the contract with the government. A subcontractor works for the prime. For a small software team, subcontracting is usually the right first move:
- The prime handles the government relationship, the contract vehicle and most of the paperwork.
- You get to prove you can deliver on real programs without carrying all the risk.
- Past performance as a sub helps you win more work later, including as a prime.
The trade-off is that you depend on the prime for work and your margins are thinner. For most firms starting out, that’s worth it.
Step 1: get registered
Even as a sub, primes will usually ask for your basic federal identifiers. Register your business in SAM.gov, the government’s System for Award Management. Registration gives you a Unique Entity ID, and you’ll also get a CAGE code. Keep your registration current, since primes check it.
Step 2: pick a lane
“We do software” isn’t a pitch. Primes and program managers are looking for a specific capability that fills a gap on a specific program. Good lanes for small software firms include:
- Data pipelines and integrations with legacy or government systems
- Operator dashboards and web applications
- Cloud infrastructure and DevSecOps
- Modernizing legacy systems
- Test automation and tooling
Pick one or two, and be ready to show work in them.
Step 3: find the primes and startups that need help
Defense work isn’t just Lockheed and Raytheon anymore. Some of the best subcontracting opportunities are at fast-growing defense startups that just won something big and need to deliver faster than they can hire.
Along the I-35 corridor, for example:
- Allen Control Systems in Austin was selected for an Army counter-drone contract with a ceiling of up to $500 million.
- Darkhive in San Antonio won a $49.7 million APFIT production award.
- Telos just won a $13.5 million contract supporting Air Force intelligence community cyber operations.
We wrote more about this cluster in the I-35 defense corridor. Local programs help too: Capital Factory’s Defense Academy at Port San Antonio connects startups with people on the government contracting side.
SBIR is another way in. The programs are reauthorized through 2031, and startups that win Phase I and Phase II awards often need engineering help to deliver. We covered that in our SBIR post.
Step 4: answer the security questions
Before a prime gives you access to anything sensitive, they’ll ask how you protect it. Have clear answers ready.
CMMC: paused, not gone
The Cybersecurity Maturity Model Certification was supposed to make third-party Level 2 assessments a condition of award starting November 10, 2026. On July 13, the Department of War suspended that Phase 2 transition. During the suspension, program offices can only require CMMC Level 1 (Self) or Level 2 (Self) assessments.
That isn’t a free pass. As Automata noted on October 7, the department says, “All Phase I self-assessment requirements remain firmly in place,” and the CMMC rule itself still contains the original phase schedule. Clark Hill adds that contractors handling covered defense information are still responsible for DFARS 252.204-7012 and NIST SP 800-171 Revision 2.
For a subcontractor, that means: know whether you’ll handle Federal Contract Information or Controlled Unclassified Information, do the matching self-assessment honestly, and keep your System Security Plan current.
Export control and ITAR
Some programs involve export-controlled technical data. On those, the prime will limit who can access the work, and you’ll need to show your team and systems can comply. Ask about this early, before you staff a project.
Your development environment
Expect questions like: Where does the code live? Who has access? Is multi-factor authentication on everything? Where does CUI live, and how is it kept separate? Having good answers is often what separates the firms that get hired from the ones that don’t.
What primes check before they hire a subcontractor
From the conversations we’ve had, primes look for:
- Delivery. Have you shipped similar work, and can they call a reference?
- Seniority. Will experienced engineers do the work, or will they be training juniors on the program’s budget?
- Security posture. Do your answers to the questions above hold up?
- Fit with their process. Will you work in their repos, tools and ticketing, or insist on your own?
- Low drama. Clear scope, honest estimates, early warnings when something slips.
Step 5: start small and deliver
Your first subcontract will probably be small. Treat it as the audition it is. Deliver on time, communicate early and leave the codebase better than you found it. Defense is a small world, and program managers talk.
Where we fit
We’re a San Antonio software firm that subcontracts for defense and dual-use companies: building software around the core product, modernizing legacy systems and setting up secure delivery pipelines. For startups without a senior technical leader, we also work as a fractional CTO.
See our defense and dual-use page, or book a call if you’re a prime or startup that needs software delivered.
