New Report Shows Defense Contractors’ Self-Reported Cybersecurity Scores Are Rising as Confidence in Their Accuracy Plunges 24 Points

The Pentagon’s CMMC program—now federal defense contract law—requires defense contractors to meet specified cybersecurity standards, but the July pause on third-party verification shifts compliance toward self-attestation. A Merrill Research study commissioned by CyberSheath evaluates implications of this change for the defense industrial base.

Analysis

Near term, this is more a timing shift than a clean revenue destruction event. For most defense contractors, cybersecurity compliance is embedded in bid overhead and program execution, so a pause in third-party verification mainly defers cash outlays and labor friction; the first-order P&L benefit is probably modest, but the second-order benefit is better bid throughput and fewer stalled awards for smaller subcontractors that were most exposed to documentation burden. That said, any relief is asymmetric: large primes can absorb self-attestation internally, while the weakest suppliers may use the delay to postpone necessary hardening, raising latent breach and contract-dispute risk later.

The biggest loser set is not the primes but the ecosystem of compliance-heavy cyber consultants, assessors, and GRC workflow vendors whose conversion cycles were likely about to accelerate. If enforcement stays soft for months, the market may start discounting a smaller addressable spend pool in federal cyber services, but if the Pentagon reinstates third-party checks, there could be a catch-up wave that benefits names with federal channel exposure. The key second-order effect is procurement leverage: primes may push unresolved compliance costs further down the supply chain, squeezing subcontractor margins rather than their own.

Contrarian view: the consensus may be overpricing immediate downside to defense IT and cyber vendors while underpricing the probability of a later snapback. Over a 1-3 month horizon, there is limited catalyst value unless the Pentagon publishes a firm reinstatement date or contract clauses start changing; over 6-18 months, the real thesis is whether self-attestation becomes de facto permanent, which would structurally reduce compliance spend but increase cyber tail risk. Falsifier: any formal reinstatement timeline or audit directive would reverse the ‘delay equals relief’ trade and shift spend back into cyber assurance quickly.

Key Decisions for Investors

• Tactically prefer a small relative-value long XAR/ITA vs short CIBR/HACK for 1-3 months: defense contractors get modest margin relief from deferred compliance, while pure-play cyber names risk deferred federal conversion. Keep the sizing light because the immediate earnings impact is likely small.
• Use CACI, SAIC, and LDOS as watchlist names rather than outright longs until management commentary confirms whether compliance spend is being deferred into 2025 budgets; upside is in reduced bid friction, not in a material revenue step-up.
• If the Pentagon publishes a reinstatement date or clarifies enforcement in the next 30-90 days, rotate out of the short cyber leg and into CIBR/HACK on the expectation of a catch-up spend cycle.
• Do not force a directional trade on defense primes alone; the more likely market effect is a few basis points of margin support, which is not enough to justify aggressive positioning absent confirmation from contract language or earnings calls.