Punch Cyber Corp

Punch Cyber Corp, doing business as Punch Cyber Analytics Group, operates as a prime contractor delivering advanced cybersecurity analytics, security operations center (SOC) engineering, and cyber defense research and development services to defense and civilian federal agencies. The company is a small business, Subchapter S corporation based in Reston, Virginia, competing predominantly in full-and-open competitive procurement and small-business set-aside vehicles (100% of recent awards are prime contracts with no subcontractor awards in the source portfolio).

Punch Cyber's customer base is heavily weighted toward defense research and civilian IT infrastructure. The top customers by potential value diverge sharply from award-count rankings. The Department of the Treasury dominates potential value with a single $20 billion BPA ceiling awarded January 2025 under the Treasury Enterprise Cybersecurity Technology and Services (PROTECTS) program, a total small business set-aside multiple-award vehicle running through January 2033. The Department of the Interior follows at $183.2 million across four awards, anchored by a $136 million single-award BPA under the Multiple Award Schedule for cybersecurity and SOC services through May 2030, from which Interior has issued multiple task orders including a $32 million advanced SOC support order and a $21 million SOC services call. The Defense Advanced Research Projects Agency accounts for six awards ($39.2 million combined potential value), including a $13.4 million Signature Management Using Operational Knowledge and Environments (SMOKE) program contract, a $4.49 million Cyber Agents for Security Testing and Learning Environments (CASTLE) contract, a $5.66 million Blue Pills research contract, and a $5.88 million Other Transaction IDV awarded June 2025 under the Advanced Resilience Through Enduring Missions (ARTEMIS) program. Punch Cyber also holds a $151 billion multiple-award IDIQ awarded by the Missile Defense Agency on December 29, 2025, for the Scalable Homeland Innovative Enterprise Layered Defense (SHIELD) program, with an initial task order valued at $500 for defense system development and research across ballistic, hypersonic, and cruise missile domains.

The vendor's capability portfolio centers on advanced cybersecurity analytics, SOC design and operations, synthetic user persona development for cyber experimentation, machine learning integration into cyber operations, signature management and attribution analysis, and cyber resilience research. Recent representative work includes the CASTLE program (AI-driven reinforcement learning toolkit for network defense simulation), the SMOKE program (signature management and evasion infrastructure), and the Defense Human Resources Activity's $2.79 million Small Business Innovation Research Phase II contract on Replicants (synthetic personas for cybersecurity experimentation). Punch Cyber also delivers risk management support and SOC services on GSA Multiple Award Schedule vehicles to the Office of the Chief Information Officer, with SCI-reportable invoicing of $328 thousand in FY2024 across 1.0 FTE and 2,195 contractor hours at a blended derived rate of $149.47 per hour, with 39 percent of hours subcontracted to two named subs. On GSA Schedules, Punch Cyber's 17 active labor categories span Cyber Security Engineer I through Functional Subject Matter Expert IV, priced between $99.00 and $241.21 per hour, all requiring bachelor's degrees and ranging from two to ten years of experience, with no security-cleared positions offered.

Activity has grown from one award annually in 2021 and 2022 to four per year in 2023, 2024, and 2025. Five awards (combined potential value $26.8 million) reach ultimate completion inside the next twenty-four months and face recompete pressure. Across SCI-reportable prime contracts, Punch Cyber subcontracts an average of 30 percent of contractor hours to seven named subcontractors, indicating a mixed make-vs-buy delivery posture for operational services. The NAICS concentration skews toward research and development (10 awards under NAICS 541711: Research and Development in Physical, Engineering, and Life Sciences) and general computer services (6 awards under NAICS 541990: Other Computer Related Services), with PSC coding split between National Defense R&D Services experimental and applied research (5 awards) and IT security and compliance support labor services (3 awards). SCI-reported invoiced revenue stands at $4.5 million in FY2024 and $0 in FY2023, with FY2024 workforce scaling to 9.9 FTEs across three prime and one subcontractor record, reflecting ramp-up from modest FY2022 baseline of 0.7 FTEs.