On May 26, 2026, a systematic audit of the federal government’s procurement database returned a number that deserves a long look: 91 percent. That is the share one company, Anduril Industries, holds in a specific slice of the federal awards system: awards in one specific procurement category, sole-source contracts inside a system that codes them as competition, across $1,008.4 million in defense-AI obligations examined from eight firms.
The precise coding language is “Full and Open After Exclusion of Sources” with exactly one offer received; the methodology section explains what it means.
Ninety-one percent concentration in a billion-dollar sample sounds like a monopoly.
What it actually is: an audit. An audit of a procurement architecture built by Congress, operated by successive administrations, and navigated with precision by a class of VC-backed defense startups. The 91 percent is not fraud. It is not rogue contracting. It is not a violation of any federal statute. It is a documented output of two legal pathways operating in structural tandem — and a window into why a competition audit of the defense-AI vertical produces a number that strange.
This piece explains the architecture. A fortcomming companion piece, Two Doors, Same Room, will examine the enterprise-vehicle and capture-via-protest mechanisms — the Anduril $31B indefinite-delivery/indefinite-quantity (IDIQ) ceiling, the Palantir $10B Army enterprise license agreement (ELA), the Palantir Defense Intelligence Agency (DIA) MARS protest — that operate alongside and on top of what you’re about to read. Those are different statutory mechanisms, different evidence, and a different structural finding. Start with either one. The architecture is the story.
Reading the Procurement Database
The federal government’s official record of its own purchases is called FPDS-NG — the Federal Procurement Data System, Next Generation. The public-facing version lives at USAspending.gov. Every contract award and contract vehicle above the micro-purchase threshold is supposed to be in there, coded across dozens of fields: what was bought, by which agency, from which vendor, for how much, and — critically — how it was competed.
That last part is what the audit focused on. Specifically: a three-field combination that serves as a fingerprint.
Field one: extent_competed. This tells you the competition category for the award. The value “Full and Open After Exclusion of Sources” is FPDS’s technical translation of one specific situation: the contracting officer applied the categorical preference for competitive procurement, then invoked a statutory exception that permitted excluding all other sources. It looks like competition at the top level; one step deeper, it is not.
Field two: number_of_offers_received. When this field reads 1, no competing bid was received — or sought.
Field three: any small-business set-aside designation. This is the final marker. When you have exclusion-of-sources coding plus one offer received plus a small-business set-aside, you are looking at the signature of a very specific statutory authority: a Small Business Innovation Research (SBIR) Phase III sole-source award under 15 U.S.C. §638(r)(4) — the SBIR program’s Phase III provision. And once you know that, you know something important about how the defense-AI vertical is built.
What the SBIR Phase III Authority Actually Does
The SBIR program operates in phases. Phase I is a small feasibility award — typically $50,000 to $300,000 — made to a startup while it is genuinely small. Phase II is a prototype development contract, typically $750,000 to $2 million. Both phases require the firm to qualify as a small business under the relevant size standard (generally under 500 employees for the applicable industry classification — the NAICS, or North American Industry Classification System, codes the government uses to define each sector’s size cutoff).
Phase III is where things get architecturally interesting.
Under 15 U.S.C. §638(r)(4), any federal agency can award a Phase III contract — a full production-scale procurement — to a firm that completed Phase I or Phase II SBIR work, without competition. The statutory language covers not just the original technology and agency, but explicitly: “a different application of the technology, including a different program or agency.” A small startup that wins a Phase I Air Force SBIR award for an AI sensor-fusion platform has just banked a predicate — a prior award that serves as the qualifying basis for later sole-source contracts — and that credential follows it indefinitely, at any agency, for any sufficiently related application.
No size requalification is required at Phase III. The small-business eligibility check happens at Phase I/II entry. Once the predicate is banked, the sole-source eligibility persists regardless of what the firm does next — how large it grows, how much VC money it raises, what its valuation reaches. The Phase III sole-source authority is a one-time eligibility gate, not an ongoing constraint.
What the contracting officer must produce is a J&A — Justification and Approval — asserting that the work “derives from” the prior SBIR funding. That derivation claim is the procedural gate; whether it functions as substantive review or administrative formality is not visible in public procurement data. The federal regulatory implementation sits at FAR 6.302-5 — a provision of the Federal Acquisition Regulation, the government-wide rulebook for buying things — with a counterpart at DFARS 206.302-5, the Defense Department’s supplement to those rules, that specifically authorizes SBIR Phase III sole-source awards across all DoD components. The J&A documents for the three anchor contracts identified in this audit are not posted in the public FPDS record. They are, as the research pack documents, a FOIA target.
Throughout this piece, “the fingerprint” refers to that one specific combination of three database fields — exclusion-of-sources coding, one offer received, and a small-business set-aside — appearing together on a single award. That trio is what this mechanism leaves behind in the database: the three-field signature of a contract that was never put to competition, because statute says it does not have to be. Wherever the audit finds all three on one record, it has found an SBIR Phase III sole-source award.
The Audit Findings: Pathway 1
Across 1,005 award and indefinite delivery vehicle records examined from eight defense-AI firms, the audit found 56 records carrying the three-field fingerprint, totaling $1,008.4 million in obligations. Here is the breakdown of the firms operating inside this architecture:
Anduril Industries: 40 records, $913.6 million. The anchor is contract vehicle 70B02C20D00000019 — the Customs and Border Protection (CBP) Autonomous Surveillance Towers indefinite-delivery/indefinite-quantity (IDIQ) vehicle. The $913.6 million figure represents total obligations across all 40 SBIR-fingerprinted Anduril records in the audit scope; the CBP vehicle alone carried approximately $862.1 million in task-order obligations between 2020 and 2026 across 23 child task orders (the individual orders placed under the umbrella vehicle), with the parent vehicle carrying a $2 billion ceiling. The parent vehicle carries the SBIR Phase III designation: one offer received, Small Business Set-Aside Total. The underlying SBIR predicates were Air Force and AFWERX — the Air Force’s innovation-procurement arm — Phase I and II awards on AI autonomy and sensor-fusion platforms. The Phase III application — autonomous surveillance towers at the southern border, awarded through the Department of Homeland Security rather than the Air Force — qualifies under §638(r)(4)(B)’s cross-agency, different-application provision. By the time the CBP task orders were flowing, Anduril’s valuation had crossed $14 billion.
Shield AI: 6 records, $19.1 million. The canonical instance is Navy IDV N6833524G0022, literally titled “SBIR PHASE III BOA” — basic ordering agreement — in the federal record. The SBIR Phase III designation is not inferred from field combinations here; it is written into the contract title. Shield AI was valued at approximately $12.7 billion at the time of its most recent documented awards.
Vannevar Labs: 4 records, $14.0 million. Vannevar Labs is a defense-software startup that builds AI tools for intelligence analysis and electronic warfare — sifting foreign-language signals, open-source data, and sensor feeds for military and intelligence users. The anchor is FA860425CB008, an AFWERX STRATFI-Velocity award — a mechanism the Air Force built specifically to convert Phase II prototypes into Phase III production awards via SBIR sole-source authority. STRATFI (Strategic Funding Increase) is the formal pipeline for exactly this conversion. The Vannevar SBIR.gov portfolio documents Phase I and Phase II Air Force and AFWERX predicates supporting the sole-source eligibility.
Palantir Technologies (transitional case): 5 records, $60.9 million, coded “No Set-Aside Used.” Palantir uses the exclusion-of-sources coding via non-SBIR statutory authority — the firm outgrew small-business eligibility years ago and cannot bank SBIR predicates. The coding recurs; the SBIR predicate does not. Palantir’s procurement architecture layers enterprise vehicles and OTA awards on top of this, a three-layer structure covered in the companion piece.
SpaceX: 258 FPDS records, zero exclusion-of-sources. SpaceX’s launch contracts are genuinely competed firm-fixed-price awards. The audit method produces no false positives on SpaceX; the three-field fingerprint does not appear. This is the negative-case anchor: competed procurement leaves a different signature.
Anduril’s $913.6 million out of the $1,008.4 million SBIR-fingerprinted total is the 91 percent — that is, Anduril holds 91 percent of all SBIR-Phase-III-fingerprinted defense-AI obligations in the audit sample. The number is large because one contract vehicle is large: the CBP Autonomous Surveillance Towers (AST) indefinite-delivery vehicle, with its 23 task orders, is the dominant mass.
The 91% is dominated by one contract — but the architecture it documents is shared. Remove that one vehicle and the 91 percent number changes, but the structural finding does not: the SBIR Phase III three-field fingerprint is shared infrastructure across the early-scaling defense-AI startup cohort, not an Anduril idiosyncrasy. Shield AI, Vannevar Labs, and Palantir all carry the same FPDS signature; Anduril’s scale is exceptional, the mechanism is not.
The Audit Findings: Pathway 2, and What FPDS Cannot See
Here is the structural finding that matters more than the 91 percent.
The firms that did not show up in the SBIR Phase III fingerprint audit — OpenAI, Scale AI, Saronic Technologies — are not absent from defense-AI procurement. They are absent from FPDS-visible defense-AI procurement — that is, the slice of federal buying that shows up in the Federal Procurement Data System at all. The mechanism they use is Other Transaction Authority (OTA), authorized under 10 U.S.C. §4022.
OTAs are procurement vehicles that are explicitly and deliberately outside the Federal Acquisition Regulation. They are not “contracts” as the Competition in Contracting Act defines that term. They are not subject to the competition requirements of FAR Part 6 (the section of the Federal Acquisition Regulation that mandates full and open competition). They are not subject, in most circumstances, to the bid-protest jurisdiction of the Government Accountability Office (GAO) — the congressional watchdog that hears challenges to how contracts were awarded. And critically: they are not coded in FPDS by extent-competed or number-of-offers-received. Those fields are designed for FAR-governed contracts. OTAs are categorically excluded from that framework.
The documented OTA awards for the firms in the audit scope:
OpenAI: zero FPDS contract records. $200 million CDAO OTA announced June 16, 2025 (CNBC). CDAO — the Chief Digital and Artificial Intelligence Office — is the DoD’s enterprise-AI procurement vehicle. Based on the audit record and the reported named awards, OpenAI’s documented federal defense engagement is OTA-mediated. None of it feeds the system the FPDS audit reads. (For the politics of these AI-to-DoD contract relationships — including the selective enforcement dynamics between OpenAI and Anthropic — see The Pentagon Banned Claude as a National Security Threat. Then It Used Claude to Bomb Iran.)
Scale AI: residual $700,000 in FPDS from a 2021 Phase I SBIR award — one small predicate, never converted to Phase III production. The firm’s actual defense engagement spans two OTA vehicles: a prime prototype contract from the Defense Innovation Unit (DIU) for Thunderforge, the DoD’s flagship AI-for-military-planning program (March 2025, contract value not publicly disclosed), and a separate CDAO Production OTA with a $500 million ceiling (originally $100 million when awarded September 2025, expanded to $500 million in May 2026). Additionally, the Army Contracting Command awarded Scale AI a $99 million R&D contract in August 2025 for data operations and AI model development. The reason Scale AI routes through OTA rather than SBIR: post-Meta investment, Scale AI is approximately 49 percent Meta-owned at a $29 billion valuation. It is not a small business. It cannot bank new SBIR Phase I/II predicates. The OTA rail is its only available non-competitive pathway.
Saronic Technologies: $500 in FPDS — a micro-contract. The substantive engagement is a $392 million Navy OTA for the Corsair Autonomous Surface Vessel, reported by DefenseScoop in August 2025 and routed through Navy OTA infrastructure rather than FPDS competition coding.
The named OTA awards — OpenAI $200 million, Scale AI $500 million CDAO ceiling plus $99 million Army R&D, Saronic $392 million, plus approximately $200 million for Anthropic under the July 14, 2025 CDAO four-vendor prototype OTA (the same vehicle that awarded $200 million each to OpenAI, Google, and xAI) — total more than $1.4 billion in non-competitive procurement that a FPDS-based competition audit cannot reach.
A methodological note on precision: those OTA figures are per-award named-press disclosures, not a consolidated audit. The $913.6 million Anduril figure is FPDS-sourced and verifiable field by field. The OTA figures are from CNBC, DefenseScoop, and DoD press releases — reliable for individual awards, but not summed from a unified dataset. The aggregate non-competitive volume across the defense-AI vertical is bounded below by approximately $2.4 billion in FPDS-visible plus named-OTA figures; the actual total requires a consolidated OTA audit that has not been conducted.
The Dual-Pathway Architecture: The Finding That Outlasts the Number
The 91 percent figure is the headline. The structural finding underneath it is more durable.
The defense-AI vertical does not have one non-competitive procurement pathway. It has two, operating simultaneously, with architectural complementarity: each pathway covers the procedural friction the other encounters.
Pathway 1 is SBIR Phase III: 15 U.S.C. §638(r)(4), FAR 6.302-5, DFARS 206.302-5. Available to firms that banked Phase I and II predicates while small. Produces FPDS-visible awards coded “After Exclusion of Sources.” Requires a J&A asserting derivation from prior SBIR work. Operates inside the FPDS system.
Pathway 2 is OTA non-competitive consortia: 10 U.S.C. §4022, administered through a set of Defense Department “innovation” buying organizations and the industry consortia they run — CDAO (the Chief Digital and Artificial Intelligence Office), the Defense Innovation Unit (DIU), AFWERX (Air Force), SOFWERX (Special Operations), and the consortium managers Tradewinds, NSTXL, and SOSSEC that assemble pre-vetted vendor pools an agency can award to without open competition. Available to firms regardless of size, so long as they can qualify for a consortium or reach a direct OTA award. Produces awards that do not carry FPDS extent-competed coding. Does not require a FAR-governed J&A (though OTA agreements often carry internal approval documentation that is functionally analogous). Operates outside the FPDS system.
Both pathways are statutorily authorized. Both have been in the federal procurement toolkit for years. What is documented here is their systemic vertical-level dual-deployment: the same vendor class operates both pathways simultaneously, with the pathway selection conditioned not on the nature of the work but on the firm’s scaling trajectory at the moment of federal-defense entry.
Firms that banked SBIR predicates while small — Anduril (founded 2017), Shield AI (founded 2015), Vannevar Labs — ride Pathway 1 for applications where the “derives from” assertion holds. Firms that arrived at scale without banking SBIR predicates — OpenAI, Scale AI post-Meta investment, Saronic — ride Pathway 2 because Pathway 1 is not available to them. Anduril is the paradigm case of dual-pathway operation: SBIR Phase III covers the CBP autonomous-surveillance-towers production line; OTA covers the Replicator initiative — the Pentagon’s program to field thousands of low-cost autonomous drones at speed — and newer DoD applications where, for a firm now valued well past $14 billion, the connection to the original SBIR predicates becomes more attenuated — a documented pattern in how SBIR Phase III scope limits apply as firms scale beyond their founding-stage eligibility window.
The pathway-selection is not a vendor-by-vendor preference. It is a function of scaling trajectory at the moment of federal-defense entry. The architecture is the through-line; the pathway taken is determined by when a firm arrived and whether it was small enough, at the right moment, to bank a predicate.
Why This Architecture Is Structurally Novel
Before the current defense-AI era, the dominant procurement-capture pattern was the Beltway-bandit revolving-door model: a traditional defense contractor maintained personal-relationship networks with program offices, and won sole-source contracts one J&A at a time. The accountability scrutiny point was the individual J&A: GAO bid protests reviewed J&A adequacy; IG investigations reviewed specific sole-source abuses; congressional oversight focused on particular procurement scandals.
The dual-pathway architecture operates one layer above the J&A.
The statutory pathways — SBIR Phase III and OTA — pre-authorize non-competitive procurement in categories defined by statute, not by individual contracting-officer judgment. A firm inside Pathway 1 does not need a fresh judgment call on competitive adequacy for each award; it needs only a procedural J&A asserting derivation from prior SBIR work, which the statutory scheme treats as an administrative threshold rather than a competitive review — and which, in practice, the documented record shows these awards passing readily. A firm inside Pathway 2 does not need a J&A at all.
The result is a vendor class that is non-competitively procured by statutory design, not by a sequence of individual judgment calls that could be reviewed and overturned one at a time. GAO bid-protest authority polices individual contract awards; SBA polices individual SBIR program integrity; DoD IG polices individual OTA-consortium decisions; Congress oversees 15 U.S.C. §638 and 10 U.S.C. §4022 separately, in different authorizing committees. No single oversight body reviews the dual-pathway vertical-deployment pattern end-to-end as a unified fact.
This is the structural accountability gap. The 91 percent concentration is the residue of Pathway 1 — the portion FPDS can see. The larger and faster-growing portion of the vertical is on Pathway 2, where the audit instrument does not reach. The audit does not reveal that a competition occurred and was lost. It reveals that a competition was structurally foreclosed before it could happen.
The Policy Acceleration: Why the Gap Is Growing
The dual-pathway architecture is an existing structure. What has changed recently is the demand side.
Executive Order 14265, signed April 9, 2025, institutionalized OTA preference at the DoD-wide policy level, explicitly directing acquisition components toward other-transaction vehicles for defense-AI procurement. Secretary Hegseth’s Warfighting Acquisition System memo pushed the same direction administratively. EO 14271 reinforced the commercial-item preference framework that the companion piece covers in detail.
The executive policy preference for OTA means that Pathway 2 is now policy-preferred as well as statutorily authorized. The demand-side of the procurement architecture has been aligned with the supply-side pathways the vendor class already inhabits.
The FPDS audit is a snapshot of the architecture’s documented output before the full effect of those 2025 policy changes has worked through the system. The $1,008.4 million Pathway 1 figure largely reflects awards obligated between 2020 and 2026; the Pathway 2 OTA figures include 2025-announced awards still early in their execution periods. If the executive-policy preference for OTA accelerates Pathway 2 adoption across the vertical, a 2028 audit of the same eight firms may show a dramatically different FPDS picture — not because competition increased, but because more of the vertical moved to the rail FPDS cannot see.
The structural accountability gap is not going to appear in FPDS. The 91 percent figure is the visible residue of Pathway 1. The faster-growing segment is on Pathway 2. The audit instrument that produced the 91 percent figure is the wrong instrument for the problem we now have.
What Responsible Oversight Would Look Like
The FPDS audit documented here is, in the language of the field, a partial audit of Pathway 1 only.
A comprehensive competition audit of the defense-AI vertical would require:
For Pathway 1: FOIA requests for the J&A documents on the Anduril CBP IDIQ (70B02C20D00000019), the Shield AI Navy BOA (N6833524G0022), and the Vannevar Labs STRATFI award (FA860425CB008) — to establish whether the “derives from” determination was substantively reviewed or applied as a procedural formality. Task-order-level offers-received data pulled directly from the FPDS-NG atom feed — the government’s raw machine-readable procurement export — because the USAspending.gov copy of that data carries unreliable values for some task-order-level fields. Cross-reference of SBIR.gov Phase I and II predicate contracts against Phase III production awards to map the derivation chain agency-by-agency.
For Pathway 2: OTA roster pulls from CDAO, DIU, Tradewinds, NSTXL, and SOSSEC covering the firms in scope. Per-consortium documentation of the consortium-establishment competitive steps, to assess whether the consortium structure was genuinely competitive at the establishment stage or whether the consortium-establishment step was de facto predetermined. Consolidated dollar-amount aggregation across the full OTA universe, which currently exists only in fragmentary form via press releases and DoD announcements.
For the vertical as a whole: A framework that can assess the cumulative non-competitive position of the defense-AI vendor class across both pathways simultaneously. GAO has the authority to conduct procurement audits. A GAO request specifically directed to examine the dual-pathway architecture — SBIR Phase III plus OTA, across the defense-AI vertical, as a unified fact — would be the appropriate oversight instrument. That audit has not been requested. Whether it is requested is a congressional decision.
What the May 26 FPDS audit established is the predicate: 91 percent concentration in the visible part of a procurement universe whose larger and faster-growing segment is structurally invisible to the instrument being used. That is enough to justify asking for an instrument capable of seeing the whole picture.
The architecture built two pathways. The audit measured one of them. The other is behind FPDS.
The RAMM documents the connections that beat reporting can’t see:
4,776+ sourced events at capturecascade.org.
1,988 Counties with signals of potential detention center expansion (Federal contracts, 287(g), real estate traces, etc) at detention-pipeline.transparencycascade.org my site that tracks signals of potential cooperation with ICE and Border Patrol.
129 Community fights over detention capacity built out tracked.
All of this is self-funded, and paid subscriptions are the only way I can continue to do this long term.
Sources
Primary Procurement Data (FPDS-NG / USAspending.gov): - Anduril IDIQ 70B02C20D00000019 — After Exclusion of Sources, 1 offer, Small Business Set-Aside Total (USAspending.gov, accessed 2026-05-26) - Shield AI N6833524G0022 — IDV titled “SBIR PHASE III BOA” (USAspending.gov, accessed 2026-05-26) - USAspending.gov API award-detail endpoint (FPDS-NG mirror) — extent_competed / number_of_offers_received / type_set_aside fields
Statutory Sources: - 15 U.S.C. §638(r)(4) — SBIR Phase III sole-source authority - 10 U.S.C. §4022 — Other Transaction Authority - FAR 6.302-5 / DFARS 206.302-5 — SBIR Phase III competition exception
Reporting: - OpenAI wins $200 million U.S. defense contract (CNBC, June 16, 2025) - Navy moves to buy autonomous maritime drones from Saronic via $392M OTA (DefenseScoop, August 22, 2025) - Anthropic awarded $200M DOD agreement for AI capabilities (Anthropic, July 14, 2025) — prototype OTA, CDAO - Anthropic, Google and xAI win $200M each from Pentagon AI chief for ‘agentic AI’ (Breaking Defense, July 14, 2025) — confirms four-vendor, $200M each, CDAO vehicle - Pentagon awards mega contracts to Musk-owned company, other firms for new ‘frontier AI’ projects (DefenseScoop, July 14, 2025) - DIU’s Thunderforge Project to Integrate Commercial AI-Powered Decision-Making (DIU, March 5, 2025) — Scale AI prime prototype OTA, DIU contracting authority - Scale AI Expands Pentagon AI Partnership to $500 Million (Scale AI, May 2026) — CDAO Production OTA, $500M ceiling; originally $100M when awarded September 2025 - Scale AI Secures $99M Army Contract for R&D Services (GovConWire, August 2025) — Army Contracting Command, competed FAR contract
Policy Documents: - Executive Order 14265 — Modernizing Defense Acquisitions and Spurring Innovation in the Defense Industrial Base (April 9, 2025)
Research Infrastructure: - FPDS Audit Timeline Event — 2026-05-26 — Capture Cascade timeline; 1,005 records; $1,008.4M; 91% Anduril - Defense-AI Dual-Pathway Procurement Architecture — Capture Cascade theme index
Companion Piece: - Two Doors, Same Room: The 2026 Procurement Architecture — enterprise vehicles and capture-via-protest (FASA commercial-item preference, EO 14265/14271, Palantir DIA MARS protest); same vendor class, different statutory mechanisms. Published at The RAMM.
Related RAMM Coverage: - The Pentagon Banned Claude as a National Security Threat. Then It Used Claude to Bomb Iran. — selective enforcement dynamics between OpenAI and Anthropic in DoD contracting; context for the CDAO OTA awards documented here. - The Hammer and the Guardrail — how the Pentagon weaponized the Defense Production Act to force Anthropic to remove AI safety guardrails; backstory to the same DoD AI contracting relationships.