RapidFort and SpaceWERX will evaluate software supply chain defenses for U.S. Space Force systems, focusing on AI vulnerabilities, ATO approvals, cyber readiness, and the transition to post-quantum cryptography.
The U.S. Space Force is opening a joint research and testing effort aimed at a less visible but increasingly consequential target: the software beneath mission systems. RapidFort and SpaceWERX, the innovation arm of the U.S. Space Force operating within the Air Force Research Laboratory structure, announced a Cooperative Research and Development Agreement on October 6, 2026. The agreement is intended to support joint development, testing, and evaluation rather than confirm deployment in active operational systems.
The agreement gives SpaceWERX access to RapidFort's open-source software supply chain ecosystem and runtime attack surface reduction tools. The work is intended for software operating in contested space domains where a weakness in a dependency or runtime environment could complicate the security of a larger system. In practical terms, the technical challenge includes identifying components, assessing how they behave during execution, and documenting the controls needed before software can enter a mission environment.
RapidFort will work with SpaceWERX operational experts, acquisition personnel, and United States Space Force Guardians. Under the arrangement, RapidFort also gains access to SpaceWERX's operational, procurement, and Guardian networks, while SpaceWERX can draw on RapidFort's commercial developers and open-source partners. The Business Wire announcement describes the initiative as a framework for co-development and evaluation, not as evidence of a completed deployment.
The collaboration combines two distinct concerns. The first is the exposure created by AI software stacks and their dependencies. The stated objective is to reduce the risk that vulnerabilities in AI-related software could be exploited while improving overall cyber readiness. The second concern is the need to prepare existing infrastructure for post-quantum cryptographic transitions required by federal cybersecurity planning.
Post-quantum cryptography is designed for conventional computing systems rather than quantum computers themselves. In this agreement it appears as a migration and infrastructure problem: software packages, cryptographic dependencies, update processes, and security controls must be assessed before new protections can be introduced across mission-critical systems. A cryptographic transition can therefore affect inventories, interfaces, certification evidence, and long-term maintenance as well as the selected algorithms.
That distinction matters. The announcement does not say that a quantum computer has compromised Space Force encryption or that RapidFort has already delivered a quantum-resilient operational system. It describes a research and testing framework for reducing future exposure and improving the process used to authorize software for operation.
Authority to Operate approvals are presented as a central target of the partnership. The participants plan to support shorter ATO timescales for new Space Force software capabilities through technical collaboration, specialized education, and a feedback loop between commercial developers, operational experts, and defense acquisition teams. The agreement also includes expansion of the "Ask a Facilities Security Officer" program, which is designed to help participants navigate clearance processes for key SpaceWERX projects.
The practical value of that loop will depend on how effectively security findings move between developers and acquisition personnel. The published material provides no measurements for approval time, no vulnerability count, no statistical analysis, and no test results. It therefore supports a description of the program's purpose rather than a claim that the process has already become faster or more secure.
RapidFort's runtime tools are intended to reduce attack surface while software is operating, while its supply chain ecosystem is intended to help identify and harden the components assembled into deployable packages. Those are complementary functions, but the announcement does not provide a specific architecture showing how either capability will be integrated into a Space Force system.
For a rigorous evaluation, investigators would need to define test environments, software populations, baseline security measures, assessment criteria, and reproducible outcome metrics. The distinction between a proposed evaluation and a validated operational result is the same methodological boundary expected in work reported by Nature, MIT, CERN, or NASA: an intended capability becomes evidence only after documented testing and independent scrutiny.
The agreement also places the initiative within a wider security transition. A separate earlier quantum link demonstration involved quantum key distribution and post-quantum security in a communications test. This CRADA addresses a different layer: the software supply chain and runtime environment supporting defense infrastructure.
That difference prevents an easy comparison between the two efforts. A free-space quantum link tests a communications channel, while this agreement concerns code provenance, software hardening, approval workflows, and cryptographic migration. Neither description alone establishes a complete quantum-secure network or a fully protected military system.
The most concrete outcome reported so far is institutional rather than technical. SpaceWERX and RapidFort have created a framework for joint evaluation with operational and acquisition participants, and the planned work is intended to support a broader industrial consortium in which participants share technical expertise, infrastructure, and operational knowledge. The release does not identify a completed test campaign, a deployed package, an independent assessment, or a measured reduction in attack surface.
That restraint is important because post-quantum readiness is not achieved by selecting a cryptographic method in isolation. Systems also require a reliable software inventory, secure implementation, disciplined updates, compatibility testing, and controls that remain effective throughout the operational life cycle. The CRADA's emphasis on supply chains, runtime exposure, and authorization workflows addresses these enabling conditions but does not by itself demonstrate that they have been solved.
The agreement is therefore best understood as an effort to connect commercial software security with defense acquisition before vulnerabilities become deployment constraints. Its significance lies in making software provenance, runtime exposure, AI-related risk, and post-quantum preparation part of the same engineering conversation. Until the partnership reports test conditions, measurable outcomes, and evidence from operational systems, it remains a serious research framework rather than proof of hardened Space Force infrastructure.
Post-quantum cryptography should be understood as a security transition for ordinary computing systems. It does not require a quantum computer to run and it does not make every implementation automatically secure. The relevant test is whether an organization can identify the software it uses, update it safely, validate the new protections, document authorization evidence, and maintain those controls across the system's operational life.
