Building A Global Collection of Application Profiles for Detecting Hidden Threats in the Software Supply Chain

The Department of the Air Force (DAF) faces a critical challenge in securing its software supply chain against sophisticated cyber threats from nation-state actors such as China and Russia. Existing security tools primarily detect known vulnerabilities but fail to uncover hidden risks embedded within third-party software. The Global Collection of Application Profiles (GCAP), developed by D&G Analytics, Inc., provides a scalable and automated solution to address these challenges. GCAP enhances software security by leveraging Holistic Risk Analysis (HRA) to detect previously undiscovered infiltration risks in trusted software applications. Unlike traditional security tools that rely on static analysis of known threats, GCAP employs differential analysis, comparing new software packages to a centralized repository of trusted application profiles. This allows for the rapid identification of unexpected code injections and behavioral anomalies before deployment. The proposed Phase II effort builds upon the feasibility study conducted in Phase I, where D&G Analytics successfully demonstrated GCAP’s capability to detect infiltration in a real-world software update scenario. This effort will further refine GCAP’s detection algorithms, enhance scalability for deployment in air-gapped and mission-critical environments, and integrate with existing DAF software distribution mechanisms such as Microsoft SCCM. By implementing automated software verification workflows, GCAP significantly reduces the burden on cybersecurity teams at Air Force Life Cycle Management Center (AFLCMC) BZAS, which currently performs manual reviews of up to 60,000 pages of software documentation per package. Automating these processes ensures faster deployment of secure, vetted applications, enhancing mission readiness while reducing the risk of software infiltration. GCAP aligns with multiple DAF Operational Imperatives, including Air Superiority, Cyber Resiliency, and the Advanced Battle Management System (ABMS). It supports Zero Trust Security principles, ensuring that all software used across DAF and Space Force operations is continuously analyzed for potential risks before deployment. Commercially, D&G Analytics has already secured contracts with Equinix and AAA, generating over $1M in revenue in its first year. The broader cybersecurity market, particularly in Zero Trust Security, represents a $36.9 billion industry, with GCAP positioned to serve both defense and enterprise customers. This Phase II effort will deliver a locally hosted prototype, demonstrate operational effectiveness within the DAF environment, and lay the groundwork for a Phase III transition, ensuring that GCAP becomes a critical component of DoD software assurance strategies.