New research and White House strategy spotlight the need to protect fielded software in defence and critical infrastructure from supply chain through runtime.
RunSafe Security has released a strategy to lead the emerging Operational Software Assurance (OSA) market – a new cybersecurity category focused on protecting the fielded software that powers US defence, critical infrastructure and other mission-critical systems throughout their operational lifecycle.
The move comes as the White House’s new National Security Science and Technology Strategy (NSSTS) elevates cybersecurity across US technology and homeland defence priorities and new independent research identifies a critical gap in protecting software already operating across defence and critical infrastructure.
Research from former Gartner analysts Brad LaPorte and Rob Smith of Lionfish Tech Advisors defines Operational Software Assurance as the next evolution of software security, extending assurance beyond development and the software supply chain to software already deployed in weapons systems, critical infrastructure, vehicles, medical devices and industrial equipment.
The report, The Call for a Digital Golden Dome, defines OSA around three capabilities: Identify, Protect and Comply. RunSafe delivers those capabilities through a platform that Identifies what is present in compiled software and firmware, including vulnerabilities, dependencies and whether vulnerabilities are reachable.
It Protects deployed binaries and firmware against exploitation through runtime protection without requiring source code changes or waiting for a patch.
It Demonstrates Compliance through continuous assurance evidence and artifacts supporting cybersecurity, regulatory and mission requirements.
“Cybersecurity has spent decades getting better at finding vulnerabilities, but finding more vulnerabilities doesn’t protect the software already operating our aircraft, weapons platforms, energy systems, factories, and other critical infrastructure,” said Joseph M. Saunders, Founder and CEO, RunSafe Security. “AI is making that gap impossible to ignore. Operational Software Assurance is about knowing what’s actually in your software, protecting it while it runs, and continuously proving that protection.”
A national security strategy built on cybersecurity
The White House’s NSSTS reinforces the timing of the emerging OSA market. The strategy places the maintenance of a next-generation missile defence shield under a Golden Dome for America alongside the protection of critical data, networks, assets and infrastructure against cyberattacks and espionage as priorities for countering strategic threats to the homeland.
The strategy also maps critical and emerging technologies against priority national security needs. Information security and cybersecurity span every mission represented, including battlefield advantage, undersea superiority, national-security AI and autonomy, border security, nuclear deterrence and missile defence, cyber defence and biological weapons defence.
Those missions increasingly depend on software that may remain operational for years or decades.
“The White House strategy makes clear that cybersecurity isn’t a separate technology problem. Instead, it underpins nearly every major national security mission,” Saunders said. “Golden Dome itself will ultimately depend on software. So will autonomous systems, C5ISR, undersea platforms, critical infrastructure and advanced weapons. Protecting those missions means protecting the software they depend on, including software already in the field.”
AI is changing the economics of software security
Artificial intelligence is making that challenge more urgent.
AI-assisted systems can analyze enormous code bases and discover vulnerabilities at machine speed, while attackers can use the same capabilities to accelerate exploit development. Remediation of fielded software, however, remains constrained by testing, certification, operational availability and lengthy patch cycles.
The result is a widening gap between machine-speed discovery and human-speed remediation.
“While AI didn’t create the problem of vulnerable legacy software, it did change the economics of attacking it,” said Shane Fry, CTO, RunSafe Security. “We cannot assume defenders will find, patch, test and recertify every vulnerability before an adversary can exploit it. For software that must remain operational, we need defenses that prevent attackers from exploiting software faster than AI can discover and exploit them.”
Building a digital Golden Dome for software
The Lionfish report describes that additional layer as Embedded Runtime Security, the Protect component of Operational Software Assurance.
Its Digital Golden Dome framework applies a missile-defence principle to software: rather than assuming every threat can be eliminated beforehand, prevent threats that reach their target from succeeding. For deployed software, that means making successful exploitation materially more difficult without waiting for the underlying vulnerability to be eliminated.
This approach complements secure development, vulnerability management, SBOMs, Zero Trust and the transition toward memory-safe languages by addressing the enormous installed base of compiled software that cannot immediately be rewritten or patched.
RunSafe’s runtime protection technology originated in DARPA-funded research and protects compiled binaries and firmware without requiring source code changes. RunSafe technology is available through the Department of War’s Iron Bank and is used across defence, aerospace and critical infrastructure environments.
Independent research points to a growing market
The Lionfish research maps more than 140 funded US defence programs across 19 DoW components whose fielded software falls within the scope of runtime protection, representing approximately US$87 billion in FY2026 procurement and US$159.5 billion in the FY2027 request. The researchers characterize the figures as measures of software exposure, not estimates of serviceable market revenue.
RunSafe sees OSA extending beyond defence into industrial control systems, energy, automotive, medical devices, telecom, rail, robotics and space sectors where software is long-lived, difficult to patch and increasingly tied to physical and mission outcomes.
“We need to build new software securely, but we also need to protect what is already deployed,” Saunders said. “Operational Software Assurance closes that gap. That’s the market RunSafe was built to address.”
