Government & Defense
Deployment Results & Procurement
Compliance alignment and procurement information for federal program offices and technical evaluation boards.
Deployed Results
Validated Against DoD Production Systems
Five production applications in DoD healthcare, baseline-assessed for CVE posture: 400+ combined findings (CRIT / HIGH / MED / LOW) across the five applications at engagement start. The CAT I-IV breakdown below reflects the security control assessment categorization, distinct from the CVE severity counts.
Glyphon ran end-to-end agentic remediation in an IL4 environment on AWS Bedrock + Llama 4 Maverick, three full passes per application.
No open scanner-detected CAT I, II, or III findings remained on any application at final scan (point-in-time, as of 2026-04-03). Remaining residuals are CAT IV, shown per application below.
Table below: end-state security control assessment (CAT I-IV) per application after remediation. The 400+ figure above is a separate CVE-posture baseline in different units, not the same measure.
| Application | CAT I | CAT II | CAT III | CAT IV | Total |
|---|---|---|---|---|---|
| System 1 | 0 | 0 | 0 | 0 | 0 |
| System 2 | 0 | 0 | 0 | 0 | 0 |
| System 3 | 0 | 0 | 0 | 0 | 0 |
| System 4 | 0 | 0 | 0 | 1 | 1 |
| System 5 | 0 | 0 | 0 | 7 | 7 |
All applications assessed on Iron Bank RHEL 9 base images. Results validated through end-to-end pipeline runs with rebuild and runtime verification.
Results delivered by Accelera Solutions on five DoD production systems, assessed in a lower-level (IL4) environment as part of the engagement (as of 2026-04-03).
SAST Posture
93.2 Composite Score on Production Codebase
Composite score (point-in-time, as of 2026-04-03) derived from weighted coverage across NIST SP 800-53, OWASP Top 10, CWE/SANS Top 25, and DISA STIG rule sets. "Coverage" means the control/rule set is mapped and assessed, not that every control passed. Scoring accounts for severity distribution and false-positive suppression.
Validated across 20+ full pipeline runs with 14-tool input including Semgrep, SonarQube, Checkmarx, and Fortify rule equivalents.
AMI Hardening
STIG Compliance Up to 99.5% Automated
Automated AMI hardening against DISA STIGs across 6 OS platforms: Amazon Linux 2/2023, RHEL 8/9, and Windows Server 2019/2022. PowerSTIG + DSC for Windows, OpenSCAP + deterministic remediation for Linux. All via SSM.
View all 6 OS hardening results (as of 2026-04-03)
99.5%
Windows Server 2022
PowerSTIG + DSC
99.5%
Windows Server 2019
PowerSTIG + DSC
83.7%
Amazon Linux 2
OpenSCAP + base rules
82%
Amazon Linux 2023
OpenSCAP + base rules
80.6%
RHEL 8
DISA STIG profile
74.3%
RHEL 9
DISA STIG profile
Windows Server 2022 + 2019: 99.5% via PowerSTIG + DSC. Amazon Linux 2: 83.7%. Amazon Linux 2023: 82%. RHEL 8: 80.6%. RHEL 9: 74.3%. Point-in-time STIG compliance as of 2026-04-03. Produces hardened AMI, compliance reports, DISA STIG Viewer checklists (.ckl), and immutable audit trail. All instance access via SSM Session Manager, no SSH or RDP required.
Validated on FedRAMP High GovCloud Infrastructure
Validated on Llama 4 Maverick on AWS Bedrock GovCloud
In a single 2026-04-03 run, the full 9-agent AMI hardening pipeline ran end-to-end on Bedrock / Llama 4 Maverick in 882 seconds with no agent failures and all 15 required artifacts (verification report, STIG checklist, hardening log, CVE scan diffs, hardened AMI ID, compliance report). No Sonnet fallback.
Every scanning, remediation, and reporting step is a deterministic tool_sequence backed by native Python helpers, OpenAI, Claude, Gemini, and Bedrock/Maverick produce identical remediation outputs on the deterministic steps. Provider choice is a cost + latency decision, not a capability decision.
SSP Generator Beta
Deterministic FedRAMP SSP Generation
System Security Plan generation designed for zero LLM inference in the compliance document itself. Document content is deterministic, sourced from the Compliance Data Layer. (Beta, in development.)
5
Agent Pipeline
End-to-end SSP generation
3
FedRAMP Baselines
Low / Moderate / High
0
LLM Inference
In compliance documents
5-Agent Pipeline
Compliance Builder, SSP Generator, Appendix Generator, SSP Reviewer, and Artifact Compiler. NIST 800-53 control mappings, CSP control inheritance, and FedRAMP baseline alignment (Low/Moderate/High).
Compliance Data Layer
Single source of truth (compliance-state.json) ensures cross-document consistency. All document content is deterministic. LLM is used only for gap review, never for compliance document generation.
Compliance
Framework Alignment
Architectural design targets, not independent certifications.
View all 7 framework alignments
NIST SP 800-53
Audit and accountability controls (AU family). Hash-chained JSONL logging, immutable artifact bundles, and multi-channel human-in-the-loop escalation (CLI, dashboard, email, Slack, SMS, Teams) with channel attribution tracking provide traceability for every AI action and human decision.
NIST SP 800-190
Application container security. Image provenance, vulnerability scanning, runtime isolation, and registry hardening aligned with container-specific guidance.
DoD Container Hardening Guide v1.2
Iron Bank STIG base images from registry1.dso.mil, non-root execution, isolated Python venv, read-only root filesystem, no-new-privileges, and layer optimization. Glyphon's own containers are hardened using its CVE resolution pipeline.
DISA STIGs (AMI + Container)
Automated STIG compliance scanning and remediation across 6 OS platforms. Windows Server 2022/2019: 99.5% via PowerSTIG + DSC. Amazon Linux 2: 83.7%. Amazon Linux 2023: 82%. RHEL 8: 80.6%. RHEL 9: 74.3%. All via SSM, no SSH or RDP (as of 2026-04-03).
DoD Image Creation Guide v2.6 + DISA Container Platform SRG
Image build pipeline compliance with Dockerfile best practices, multi-stage builds, and vulnerability-free base layers. Container platform alignment including network policies, secrets management, and resource constraints.
DoD CNCF Kubernetes Reference Design
Architecture alignment with DoD reference design for cloud-native deployments, including service mesh, observability, and policy enforcement.
IV&V Readiness + CUI Marking (DoDI 5200.48)
Every source file carries an explicit CUI marker per DoDI 5200.48 and 32 CFR Part 2002 (157+ files, idempotent applier). Requirements Traceability Matrix links requirement → design → implementation → test → E2E evidence. Seven CI gates enforce code quality on every PR across engine and frontend.
Deployment
Cloud to Edge: Run Anywhere
View all 6 deployment models
Cloud (IL2 target)
OpenAI, Anthropic, Google, AWS Bedrock. Full provider selection with lowest per-run cost. Ideal for unclassified development and CI/CD integration.
Containerized
Three container tiers: local HTTPS, production slim, and Iron Bank STIG-hardened (UBI9, non-root, read-only rootfs). Web dashboard, visual editor, and template gallery. CDK stack for AWS Fargate.
GovCloud (IL4 target)
AWS Bedrock GovCloud with Llama 4 Maverick. Managed inference running on FedRAMP High GovCloud infrastructure, validated end-to-end on the full AMI hardening pipeline. Same playbooks and agents, classified infrastructure. Grafana Federal Cloud for observability.
Air-Gapped (IL5 target)
Data never leaves the enclave. Run local models via self-hosted Bedrock endpoints or on-prem inference. Open Telemetry traces to Grafana (FedRAMP High + DoD IL5). Deterministic tool_sequence pipelines produce identical artifacts whether the model is SaaS or on-prem, with no external SaaS dependency.
Edge / Tactical
Run on NVIDIA DGX Spark, RTX GPUs, or AMD AI Max at the tactical edge. Same playbooks, disconnected operations. Designed for forward-deployed and DDIL environments.
Workstation
Develop and test playbooks on any workstation: macOS, Linux, or Windows. Rapid iteration with the same CLI used in production. No special hardware required.
Deterministic agents (scanners, parsers, validators) run as native Python, no LLM calls, no token cost.
All deployment models use FIPS-capable Iron Bank base images with identical playbook definitions.
Impact Level reflects the target authorization boundary, a property of your enclave, not the software itself.
Engineering
Built to Be Audited
Every pipeline run produces a complete artifact bundle: hash-chained audit log, agent conversation transcripts, scan results (before and after), file diffs, cost accounting, and a structured summary report. All artifacts are self-contained, with no external service dependencies for post-run analysis.
Glyphon's own deployment containers are built on STIG-hardened Iron Bank base images from registry1.dso.mil, then further vulnerability-scanned and hardened using Glyphon's CVE resolution pipeline. The same pipeline hardens Glyphon's own containers.
The Visual Playbook Editor enables rapid pipeline development without writing YAML by hand. Drag agents from a palette, connect them to define execution order, configure settings, and deploy. Program offices can adapt existing templates or build custom pipelines for their specific compliance requirements.
Visual Playbook Editor example: a DAG pipeline showing five agents (Trivy Verifier with default model and 40-turn budget, Dockerfile Reviewer with gpt-4.1 and 15-turn budget running in parallel, Base Image Upgrader with gpt-4.1 and 30-turn budget running in parallel, Dependency Mapper with default model and 40-turn budget running in parallel, and Resolver Critical-High with gpt-4.1 and 50-turn budget). The properties panel shows config, instructions, YAML, and pipeline tabs for the selected Resolver agent. A left palette lists six agent archetypes (Scanner, Analyzer, Remediator, Validator, Documenter, Compiler) and two playbook templates (trivy-playbook with 10 agents, semgrep-playbook with 8 agents).
Visual Playbook Editor: design DAG pipelines with fan-out parallelism, configure edge conditions, and export runnable playbooks
Observability
Trace Every AI Action
Open Telemetry + Grafana
Purpose-built for government and air-gap deployments. Pipeline traces flow through the Open Telemetry Collector to Grafana Tempo, with metrics in Prometheus and visualization in Grafana. Self-hosted, no data leaves the enclave.
Langfuse
SaaS or self-hosted LLM observability platform. Semantic trace hierarchy with typed observations: agents, tools, LLM generations, verification gates. Auto-scored pipeline metrics: CVE resolution rate, agent efficiency, and per-run cost tracking.
Every pipeline run produces a complete trace: agent spans with tool call events, LLM request metrics, verification gate results, and pipeline-level scores. Zero overhead when disabled, the NoOp backend adds no imports, no I/O, no latency.
Full Pipeline Observability
Every agent run, tool call, and LLM request traced end-to-end. Auto-scored pipeline metrics surface cost, efficiency, and resolution rate.
Observability trace example for pipeline:trivy-playbook showing a successful run. Resolution score 76 of 100, prompt-cache savings 89%, total cost $2.41 over 12 minutes 34 seconds. Per-agent breakdown: Trivy Scanner 1m12s $0.14 18.2K tokens; Base Image Upgrader 1m45s $0.19 22.1K tokens; Resolver Critical-High 3m22s $0.92 84.6K tokens with 92% and 96% cache hit on sub-calls; Resolver Med-Low 2m51s $0.68 71.3K tokens; Scan Verifier 1m21s $0.31 31.2K tokens. CVE regression gate passed: 142 CVEs reduced to 34.
Langfuse trace view: per-agent cost breakdown, prompt cache savings, turn efficiency, and verification gates
Procurement
Glyphon engagements are delivered by Accelera Solutions, the sole contracting point of contact. SigilArk is Accelera's small-business affiliate.
Contracting Entity
Past performance references available upon request.
Schedule a Briefing
Glyphon™ is the capability Accelera Solutions brings to federal and commercial engagements. Schedule a capability briefing or technical demonstration.
Schedule a Briefing