Defense contractors are still struggling with the basics. A new report finds that only two-thirds of firms submitting CMMC self-assessments are confident those scores reflect their actual posture, and the median contractor believes it’s just 70% ready for a certification review. That’s down from 89% confidence in 2025 and 94% in 2024—a troubling trend as the threat environment intensifies and DoD continues to use the False Claims Act to prosecute misrepresentation.
The confidence disconnect matters because it signals a gap between what contractors report and what they can defend under scrutiny. When we map the market for cleared cybersecurity leaders, we’re often surfacing candidates who’ve spent the last two years helping primes and subs close that gap—standing up vulnerability management programs, implementing MFA at scale, or preparing evidence packages for third-party assessments. The firms that pass on the first try aren’t the ones with the shiniest tools; they’re the ones with operators who understand that compliance is a continuous posture, not a point-in-time exercise.
What’s interesting is that contractors now want DFARS and CMMC requirements extended to their own vendors—MSSPs, MSPs, and other tech providers. More than 80% said managed security providers should be covered. That tells you the supply-chain risk is real and that primes are tired of being the weakest link by proxy. If you’re leading cybersecurity for a contractor or building a program from scratch, the lesson is clear: your readiness depends as much on your vendors’ posture as your own, and the government is watching both.