JUSTIFICATION AND APPROVAL

For Other Tan Full and Open Competition FAR Part 6

Argonne Ridge JCITS FY26

1. Agency and Contracting Activity:

The Defense Counterintelligence and Security Agency (DCSA), Procurement Solutions (PRS) Directorate, is the procuring activity for this action. The PRS Directorate proposes to enter into a contract action on an other than full and open competition basis with Argonne Ridge Group, LLC (CAGE CODE 4JRQ4) on behalf of DCSA Counterintelligence and Insider Threat, Cyber Mission Center (CIC).

2. Description of Action:

Action Description: Follow-On Contract Contract Type: Firm-Fixed Price Types of Funds: Fiscal Year 2026 Operations & Maintenance Funds

3. Description of the Supply or Service:

a. This order is for:

i. Augury Platinum unlimited User Interface (UI) queries/account/day, 15 individually name accounts (seats) with both UI and Application Programming Interface (API) (30 queries/user/day) access, largest Classless Inter-Domain Routing (CIDR) block per query is /8, 3TB Results storage on hosted system, and 3M Rows per result per query type.

ii. Augury add-on (now Torrent): The Augury Add-on Service is a network meta-data telemetry service.

iii. Scout-Ultimate: This is an additional charge to an Augury subscription that provides a quick search tool within the Augury portal for single Internet Protocols (IP)s, domains, or entire CIDR ranges related to observed activity. Results are tagged as infrastructure, malicious, suspicious, or device. It includes 1,000 monthly total queries (simple and advanced, shareable), up to 30 days search in 90 days traffic history for all datasets available, 1,000 max communication results and API access.

iv. Augury Header Feeder: Incorporating Hypertext Transfer Protocol (HTTP) and Hypertext Transfer Protocol Secure (HTTPS) header fields in data help ensure DCSA is receiving only data directed at the companies that we have security purview over. Headers contain the requested domain name, allowing DCSA to discard network records not applicable to their mission, and keep records that are routed to their facilities.

b. The capability for this action will support the Joint Cyber Intelligence Tool Suite (JCITS) and must:

i. Provide access to petabytes of network data from extensive collection points across the world;

provide high-volume (more than 100 billion) real-time updates of netflow, Domain Name System (DNS), and cookie usage data; provide active monitoring of Beaconing activity, Internet Relay Chat (IRC) keyword analysis, and access to Pastebin archived data; and have the ability to from Internet Message Access Protocol (IMAP), Point of Publishing (POP), Simple Mail Transfer Protocol (SMTP), Remote Desktop Protocol (RDP), and File Transfer Protocol (FTP);

be specialized for mission-critical analysis, threat detection and responding to sophisticated cyber threats.

Pastebin data refers to the plain text content uploaded to paste websites and is used by threat actors to publish stolen databases, leaked credentials, and malware components. The data is a publicly accessible critical asset for CIC to continuously monitor threats and early identification IoCs. It is even more critical for the selected predictive analytic tool to provide access to archived Pastebin data for CIC to correlate known IoCs to identify FIE threats in support of CCs, DCSA, and OGAs. Previously known or identified threats contained within archived Pastebin data are just as important as the identification of new and emerging threats in the current Pastebin data. Without access to archived data, CIC will not be able meet its mission to enable and support counterintelligence activities in cyberspace to detect, understand, and anticipate cyber-based threats to cleared industry, cleared personnel, DoW, and DCSA. Real-time updates of netflow data are critical for the Government to quickly identify FIE actively monitoring NISP facilities.. Real-time updates of netflow data are continuously ingested through streaming pipelines into predictive analytic tools and optimizes the immediate detection of FIE activity. Near-real-time netflow data are ingested after a delay, which is variable ranging anywhere from 1 minute to 15 minutes or more due to various unknown factors. The variability in threats, which would create a gap that FIE could exploit for cleared facilities that do not have sophisticated cyber capabilities. Access to world-wide data across the NISP is critical for CIC to map cleared contractor public infrastructure and fuse those maps with known cyber-attack patterns of foreign adversaries across NISP and not just within the DCSA network. These factors, or a combination thereof, limit the capability of the identified vendors to meet the specific needs of the Government.

Augury is the predictive analytics tool that currently supports JCITS as a software-as-a-service (SaaS) providing netflow data (data feed). Augury enables access to a massive, global repository of current and historical network data. The tool provides insights into internet browsing records, Border Gateway Protocol (BGP) data, DNS, Network Mapper scans, Pastebin archives, and various packet capture (pcap) data for cybersecurity and threat detection. It is used to identify attack vectors, monitor nuclear enterprise threats, and support military information groups. Augury also is the graphical user interface front end to access multiple petabytes of insightful data. Each file is available for download either in Excel, eXtensible Markup pt Object Notation or Comma-Separated Values. Subscribers also get access to numerous data sets and hundreds of pods located globally throughout the Internet with the capability to accurately detect and tag IP addresses that are scanning for other vulnerable hosts. Presently they log and tag (identify the malware) tens of millions of such IP addresses per week. These networks range from academic, enterprise, and transit. Augury offers the availability of various service options dedicated to mapping IPv4 numbers to BGP prefixes and ASNs. Each of the services is based on the same BGP feeds from dozens of BGP peers and is updated at 1-hour intervals.

Predictive tools are not plug-and-play; their effectiveness depends on the quality, volume, and maturity of the data and threat feeds they are trained on. Alternative tools are too fragmented and would degrade situational awareness compared to the integrated capabilities of the Augury platform. As such, Argonne Ridge Group LLC is the only known firm capable of providing specific proprietary technology for Augury;

there are no other known producers or resellers (See Section 7. Market Research). These features make Augury the only one of its kind.

This sole source requirement will enable DCSA to strengthen capabilities to continually identify, evaluate, and mitigate FIE threats to the DoW and the national security industrial base. CIC supports DCSA's mission to protect the national industrial security base in accordance with DoDD 5105.42, DoDM 5240.01, DoDD 5240.02, DoDI 0-5240.10, and 32 CFR part 117. Information derived from these efforts supports and informs other DCSA Directorates and mission areas, cleared industry and academia, and the broader Intelligence Community through a series of publications to include Cyber Threat Alerts, Shared Indicator Bulletins, Threat Vulnerability Reports, and Intelligence Information Reports.

platform designed to detect, investigate, and respond to novel, unknown threats in real-time by understanding an organization's unique "pattern of life" rather than relying solely on historical attack signatures. Its predictive capabilities are centered on behavioral anomaly detection, allowing it to spot subtle deviations that indicate emerging threats, such as zero-day exploits, insider threats, and lateral movement. While ding real-time updates of netflow, DNS, and cookie usage data and actively monitoring Beaconing activity and IRC key word analysis, it does not offer access to Pastebin archived data.

analyzes large data sets, providing user behavior analytics (UEBA) and risk-based alerting. It offers a suite of AI-driven, predictive analytic tools designed to transform security data into actionable insights, helping to identify and mitigate threats before they escalate.

offers similar capabilities to and meets similar Government requirements. However, similar to does not offer access to Pastebin archived data.

offers predictive threat detection to prevent malware and ransomware. It is primarily delivered through which uses AI-driven insights to shift from reactive defense to proactive risk mitigation. The core technology, , continuously analyzes billions of security events to predict which vulnerabilities are most likely to be exploited. , like and , does not offer access to Pastebin archived data.

does not actually provide the underlying network data required for JCITS. It is a predictive analytical tool that aggregates and displays data obtained from other sources. The Government already has tools that perform pure aggregation and visualization, and there would not meet the requirement without additional data-feed purchases. In contrast, Augury provides both raw real-time data and integrated analytics in a single platform, without require separate third-party data subscriptions. is an AI-ready, "agentic" security platform that heavily utilizes predictive analytics, machine learning (ML), and graph-powered context to transition from reactive detection to proactive threat anticipation. It acts as a cloud-native Security Information and Event Management and Security Orchestration, Automation, and Response platform that consolidates data, identifies anomalies, and automates responses at scale.

-time updates of netflow data. Real-time updates of netflow data are continuously ingested through streaming pipelines into predictive analytic tools and optimizes the immediate detection of FIE activity. only offers near-real-time netflow data through a third party. Near-real-time netflow data involves a slight delay, which is variable ranging anywhere from 1 minute to 15 minutes or more due to various unknown factors. The variability in the delay creates a quickly inform the NISP of potential FIE threats, which would create a gap that FIE could exploit for cleared facilities that do not have sophisticated cyber capabilities.

Both and indicated that they are not authorized to sell or distribute any portion of Augury.

data, unlike Argonne Ridge who offers world-wide data across the NISP. Access to world-wide data across the NISP is critical for CIC to map cleared contractor public infrastructure and fuse those maps with known cyber-attack patterns of foreign adversaries across NISP and not just within the DCSA network.

Predictive tools are not plug-and-play; their effectiveness depends on the quality, volume, and maturity of the data and threat feeds they are trained on. Alternative tools are too fragmented and would degrade situational awareness compared to the integrated capabilities of the Augury platform.

Argonne Ridge Group LLC is the only known firm capable of providing this specific proprietary technology.

There are no other known producers or resellers of the Augury tool. These features make Augury the only one of its kind. Making a sole source order with Argonne Ridge is in the best interest of the Government and requirements.

8. Other Facts:

Procurement History: Augury was previously procured as other direct cost (ODC) attributed to managing the licenses of the software-as-a-service supporting JCITS on the task order General Services Administration (GSA) Contract with vendor covering a 12-month Base Period (September 29, 2022 through September 28, 2023) and two 1-year option periods (September 29, 2023 through September 30, 2025). The contract was Firm-Fixed Price. At the close of the task order GSA Contract CIC leveraged an existing DCSA Office of Chief Information Officer (OCIO) contract with covering a 12-month option period (June 30, 2025, through June 29, 2026), with no remaining option years. Leveraging the existing OCIO contract, CIC procured a 12-month subscription renewal on September 28, 2025 (through September 27, 2026) for Augury service. The contract is Firm-Fixed Price with no remaining option periods.

Subcontracting Competition: The Government requires the Primary Contractor to comply with Competition in Subcontracting (FAR 52.244-5): The Contractor shall select subcontractors (including suppliers) on a competitive basis to the maximum practical extent consistent with the objectives and requirements of the contract.

Other Items: Technical data packages, specifications, engineering descriptions, statements of work, or purchase descriptions suitable for full and open competition have not been developed because Augury is proprietary to Argonne Ridge, LLC.

Government to procure highly effective capabilities for JCITS to properly correlate information against known IoCs to identify FIE threats. Threat and vulnerability information is shared with CCs, DCSA, and Other OGAs. As such, JCITS supports DCSA's mission to protect the NISB in accordance with DoDD 5105.42, DoDM 5240.01, DoDD 5240.02, DoDI O-5240.10, and 32 CFR part 117. Information derived from these efforts supports and inform other DCSA Directorates/mission areas, cleared industry and academia, and the broader Intelligence Community through a series of publications. Predictive tools are not "plug-and-play"; their effectiveness depends on the quality, volume, and maturity of the data and threat feeds they are trained on. Alternative tools are too fragmented and would "degrade situational awareness" compared to the integrated capabilities of the Augury platform. If the predictive analytic tool supporting JCITS is not acquired from Argonne Ridge, LLC or if a lower quality/less effective tool is acquired, there is an increased risk of network intrusion, critical data/technology compromise, degrading a national security posture and competitive warfighter advantage.

9. Interested Sources:

To date, no other sources have written to express an interest in the requirement. No Request for Information was issued since publicly available information through general search engines (i.e., Google)p, and other government websites (i.e., SBA.gov, esi.mil) did not identify vendors who meet the requirements of the Government.

10. Actions to Increase Competition:

DCSA will continue to monitor the market to determine whether there are any alternative sources available continue to engage sources through informational meetings, informal requests for information, and capability demonstrations. In addition, the Government will attempt to develop technical data packages, specifications,