Everfox LLC

Everfox LLC, a subsidiary of RTX Corporation headquartered in Herndon, Virginia, sells user activity monitoring software, insider threat detection, cross-domain solutions, high-speed guard systems, and related cybersecurity professional services to federal defense and civilian agencies as a large-business prime contractor (82% of recent awards) and as a subcontractor to major defense primes.

Everfox competes full-and-open across all federal work; the vendor carries no set-aside designations. The company's primary NAICS classifications track to software publishing and IT service delivery (NAICS 511210, 541511, 541512), with performance split across user activity monitoring software licensing, maintenance and support services, and custom cross-domain security engineering. The vendor's portfolio spans defense intelligence applications, civilian agency cybersecurity infrastructure, and network security operations support, with particular depth in law enforcement, military intelligence, and Air Force counterintelligence programs.

Customer concentration is pronounced. The top five funding agencies by combined potential value account for 45% of recent awards: the Department of the Air Force leads with 32 awards valued at $956.8 million combined potential, followed by the Defense Information Systems Agency (14 awards, $143.6 million), the Federal Bureau of Investigation (112 awards, $121.9 million), the Naval Information Warfare Systems Command (66 awards, $41 million), and Air Combat Command (30 awards, $34.3 million). The FBI holds the largest award-count share in the portfolio, but the Air Force dominates by dollar value — a signal that Everfox's largest individual contracts cluster with Air Force entities while the FBI places numerous smaller orders across multiple task orders. Everfox also serves the Department of State, Department of Justice Drug Enforcement Administration, Defense Counterintelligence and Security Agency, Defense Threat Reduction Agency, Social Security Administration, and over 100 other federal agencies.

Vehicle position is anchored to GSA Multiple Award Schedule (MAS) delivery orders. Everfox holds a GSA Schedule contract (GS35F0084J) from which 422 task orders have been placed, totaling $66.1 million in combined potential value. An additional 115 task orders across various MAS vehicles total $209 million. The vendor also operates under a $69.3 million single-award Indefinite Delivery Contract with the Department of the Air Force (awarded August 2021, ultimate completion August 2026) for Forcepoint cybersecurity solutions, user activity monitoring software, hardware, professional services, and maintenance support. Under this Air Force vehicle, the vendor has issued multiple firm-fixed-price delivery orders including a $17.1 million User Activity Monitoring and Analytics contract (FABRIC 1) for counterintelligence operations, a $7.8 million follow-on monitoring and analytics order (FABRIC 2), a $3.5 million Space Force NIPRSET User Activity Monitoring Pilot, and additional orders for Forcepoint licenses and management. Everfox also holds a $24.7 million single-award Blanket Purchase Agreement with a civilian agency Headquarters Division (awarded September 2025, through September 2030) for software, hardware, professional services, and maintenance, and a $15.6 million multiple-award BPA with the Office of Management (awarded June 2025) for software and support services priced on time-and-materials basis.

Activity has grown substantially over the past five years — from 18 awards in 2022 to 76 in 2024 — with a recent slowdown to 5 awards in the truncated 2026 period to date. Across the full award portfolio, Everfox carries 891 prime and sub awards valued at $2.87 billion combined potential value, with $618.6 million obligated (22% of potential value). Nineteen awards with ultimate completion in the next twenty-four months carry combined potential value of $131.9 million and face recompete risk.

Representative recent prime work includes a $91.8 million Defense Information Systems Agency Definitive Contract for user activity monitoring solution software (awarded May 2022, completion May 2026); a $22.9 million Bureau of Diplomatic Security delivery order for Forcepoint license renewal, services, maintenance, and support (awarded June 2022, completion June 2027); a $17.1 million Air Combat Command delivery order for user activity monitoring and analytics supporting counterintelligence (awarded March 2024); a $12.8 million Social Security Administration delivery order for user activity monitoring software subscription and services (awarded April 2024, completion April 2029); a $7.15 million Army Redstone Arsenal Field Office purchase order for an Insider Threat Management Suite with UEBA capabilities (awarded December 2025, completion December 2030); and a $5.7 million Department of Defense Inspector General delivery order for user activity monitoring solutions (awarded September 2025, completion September 2030).

As a subcontractor, Everfox performs across a breadth of defense and intelligence work. Named prime contractors include Science Applications International Corporation, General Dynamics Information Technology, Booz Allen Hamilton, L3Harris Technologies, Lockheed Martin, Raytheon Company, Peraton, CACI, and Amentum Technology. Work ranges from Air Force weather sustainment support and cross-domain enterprise user repository (CENTAUR) maintenance to integrated air and missile defense systems engineering, fire control systems support, e-4b software sustainment, and high-performance computing cybersecurity services. The vendor frequently subcontracts its Everfox and Forcepoint software products, G2 Custom Federal Cross Domain solutions, High Speed Guard system maintenance, and Trusted Thin Client licenses to larger primes filling specialized cybersecurity and data security roles.

Across SCI-reportable federal service contracts (covering awards above $150,000 and excluding goods, classified work, and non-federal revenue), Everfox invoiced $8.3 million in prime contract work across FY2022–FY2024: $89 thousand in FY2022, $6.1 million in FY2023 (12.0 FTEs), and $2.1 million in FY2024 (4.4 FTEs). Government-paid rates on prime contracts median around $226.96 per hour, with the 10th percentile at $104.41/hr and the 90th percentile at $296.49/hr, reflecting a mix of engineering support, system administration, and senior technical roles. Across SCI-reportable prime contracts, subcontractors account for an average of 9% of total hours; the vendor self-performs the bulk of labor and names two primary subcontractors in SCI records. GSA labor categories span junior to senior product engineers and project leads, priced from $219.44/hr to $395.84/hr, all requiring bachelor's degrees and federal security clearances.

Everfox's federal footprint reflects RTX's position as a strategic cybersecurity and data protection provider to defense and intelligence customers. The company's focus on user activity monitoring, insider threat detection, cross-domain solutions, and trusted gateway technologies positions it as a specialized infrastructure vendor serving persistent federal requirements for personnel security monitoring, counterintelligence operations, and critical information system protection across the Department of Defense, intelligence community, and civilian agencies.