Resilient Software Systems Capstone

The Defense Advanced Research Projects Agency, through its Information Innovation Office, has released solicitation DARPA-PS-25-29 for the Resilient Software Systems Accelerator. This initiative seeks to address growing cybersecurity risks to Department of Defense systems that rely heavily on outdated information technology and decades-old security protocols. Threat actors, including state-sponsored espionage groups, are exploiting these vulnerabilities to access sensitive military systems, steal proprietary source code, and potentially compromise national security. The program builds upon DARPA’s prior investments in formal methods, an approach to software verification that uses mathematical proofs to eliminate exploitable vulnerabilities before deployment. The Accelerator’s primary objective is to broaden adoption of formal methods tools across the defense industrial base and beyond, with the aim of achieving inherently secure software and streamlining development processes. The program emphasizes generating measurable improvements in security, efficiency, and cost-effectiveness by integrating formal verification methods into defense software pipelines. To demonstrate impact, the program follows a structured three-step process: an initial red team assessment of vulnerabilities, the application of formal methods tools by integrated teams of defense contractors and tool developers, and a final red team evaluation to verify improvements. These results will contribute to DARPA’s forthcoming Formal Methods Implementation Best Practices Guide, which will provide a standard reference for future adoption across the DoD. Awards under this solicitation will take the form of Other Transaction agreements for prototype projects authorized under 10 U.S.C. § 4022. The expected performance period is 18 months, beginning in December 2025. Participants must demonstrate the ability to integrate formal methods tools into real-world defense software applications such as command and control, weapons guidance, communications, encryption, and embedded systems. Eligible entities include large and small businesses, nontraditional defense contractors, and research institutions. However, DARPA discourages submissions from Federally Funded Research and Development Centers and University-Affiliated Research Centers, except in exceptional circumstances. Teams must consist of distinct organizations representing both defense industry partners and formal methods developers; proposals from a single entity serving both roles will not be considered. The solicitation includes multiple key dates. Abstracts are due by October 3, 2025, and questions must be submitted no later than September 25, 2025. Proposers Day will be held virtually on September 11, 2025, to provide additional program information. Oral presentations are by government invitation only and are expected to begin November 5, 2025. Award notifications will follow evaluation and negotiation, with projects anticipated to begin in December 2025. Throughout the 18-month program, awardees will be required to submit monthly technical and financial status reports, a comprehensive final report, and draft chapters for the Best Practices Guide. DARPA anticipates making multiple awards, each at or below $3 million, though budgets must align with the technical scope and complexity of the proposed solution. Cost sharing may be required under certain circumstances consistent with statute. Deliverables will be non-proprietary to support broad adoption, and DARPA strongly encourages open-source rights for tools developed under the program. Classified and Controlled Unclassified Information may be involved, requiring awardees to comply with federal security and information handling requirements, including facility clearances, personnel security, and adherence to NIST SP 800-171 for CUI systems. The solicitation is overseen by the Information Innovation Office, with all questions directed to the program’s Solicitation Coordinator at ResilientSoftwareSystems@darpa.mil. Mail inquiries may be addressed to DARPA/I2O, ATTN: DARPA-PS-25-29, 675 North Randolph Street, Arlington, VA 22203-2114. The program is led by Program Manager Stephen Kuhn. Prospective proposers are encouraged to review the solicitation in detail to ensure compliance with eligibility, security, and submission requirements, as DARPA reserves the right to make multiple awards, no awards, or follow-on production contracts without further competition.

Developing a Best Practices Guide to support broad adoption of these tools.