CMMC Was Designed to Raise the Bar on Cybersecurity. It May Also Accelerate the Defense Industry’s AI Transformation.

Defense manufacturing modernization is being forced by an unlikely source: cybersecurity compliance. For the U.S. defense industrial base, cybersecurity has traditionally been viewed as a compliance challenge: protect controlled information, satisfy government requirements, pass the assessment, and remain eligible to compete. That perspective may be too narrow.

Notably, the next phase of the Cybersecurity Maturity Model Certification (CMMC) rollout could do more than change how defense suppliers approach cybersecurity. It could force a technology modernization cycle that ultimately changes how these companies operate. And, perhaps unexpectedly, it could accelerate the adoption of artificial intelligence across the defense supply chain.

Compliance Is Becoming an Architecture Decision

Importantly, the significance of CMMC is not simply that defense contractors face another cybersecurity requirement. The bigger issue is what compliance requires organizations to do with their underlying technology.

Specifically, CMMC Phase 2 was scheduled to expand third-party Level 2 assessment requirements for organizations handling Controlled Unclassified Information (CUI) beginning November 10, 2026. In July 2026, the Department of War suspended that milestone and convened a CMMC Reform Task Force to review the program. What the pause did not change is the underlying obligation: Level 1 and Level 2 self-assessments, DFARS 252.204-7012, and the 110 security requirements in NIST SP 800-171 Revision 2 all remain in force. NIST has since superseded Revision 2 with Revision 3, but the Department has kept CMMC and DFARS obligations tied to Revision 2, so those 110 requirements remain the operative baseline.

However, for many manufacturers, meeting those requirements cannot be accomplished by adding another security tool to an aging technology environment. It requires organizations to understand where sensitive information resides, who can access it, how it moves through the business, how systems are monitored, and whether they can produce evidence that appropriate controls are actually working. As a result, that turns cybersecurity into an architecture question. And architecture has consequences far beyond compliance.

The Defense Manufacturing Modernization Effect Nobody Is Talking About

In fact, defense manufacturers have historically had good reasons to move cautiously. Specifically, they operate in highly regulated environments. Their systems may be deeply embedded in validated processes. Their supply chains can include decades-old technologies alongside modern applications. And the consequences of disrupting an operational system can be significant.

As a result, defense manufacturing modernization has often been deferred. CMMC changes that equation. Organizations may now have to modernize portions of their technology environment simply to remain eligible for certain defense opportunities.

Consequently, this creates a secondary effect: the same foundation being built for security and compliance is also the foundation required for more advanced forms of automation and AI. A controlled cloud environment. Governed data. Defined access rights. Integrated applications. Traceable transactions. Reliable information. In short, these aren’t just cybersecurity requirements. They’re prerequisites for trustworthy AI.

AI Doesn’t Start With the AI

Currently, there is a tendency to frame enterprise AI as a software decision. Which model should we use? Which AI platform should we buy? Where can we deploy an agent? For manufacturers, those may actually be the wrong first questions.

Instead, the more important question is whether the organization has a technology environment where AI can operate safely. An AI system that recommends a supplier, adjusts a production schedule, releases a purchase order or changes an inventory strategy is only as reliable as the data and business rules surrounding it.

Notably, that is particularly important in defense manufacturing. A disruption involving a sole-source component or long-lead material isn’t simply a procurement inconvenience. It can affect production schedules, program commitments and ultimately the delivery of critical equipment.

Ultimately, the opportunity for AI isn’t necessarily to replace the people making those decisions. It is to help them get to the decision faster.

For example, imagine an AI agent monitoring supply and demand signals, identifying an emerging shortage, reviewing qualified alternatives, checking inventory and supplier constraints, and presenting the buyer with a recommended course of action. Importantly, the human still makes the judgment call. But the human no longer has to spend hours gathering the information needed to make it. That distinction, AI assisting with decisions rather than making them blindly, is likely to be especially important in regulated manufacturing.

The Real Opportunity Is Agentic

Initially, the first generation of enterprise AI largely focused on information. Find this document. Summarize this report. Answer this question.

By contrast, the next generation is increasingly about action. Identify an exception. Determine what needs to happen. Execute the appropriate steps. Escalate when human judgment is required.

Therefore, for defense manufacturers, that shift could be significant. Consider inventory. An AI agent could identify excess inventory, evaluate future demand and supply risk, and recommend opportunities to reduce working capital without compromising production requirements.

Similarly, consider production. An agent could monitor schedules and material availability, identify potential disruptions and recommend adjustments before a problem reaches the shop floor.

Additionally, consider procurement. An agent could monitor supplier performance and lead times, identify risks and surface alternatives before a buyer is forced into an emergency response.

Overall, none of these scenarios require eliminating the people responsible for the operation. Instead, they require giving those people better systems.

But There Is a Catch

However, there is an understandable concern among defense manufacturers: modernization itself can create risk. If an organization has spent significant time and money establishing a compliant environment, the last thing leadership wants is to destabilize that environment every time a new technology becomes available.

Consequently, this is where technology architecture becomes critical. The organizations best positioned to adopt AI will not necessarily be the ones with the most AI tools. Moreover, they will be the ones with a stable, governed technology core that allows new capabilities to be introduced without constantly rebuilding the foundation underneath them.

That means thinking about defense manufacturing modernization differently. Instead of asking, “How do we become CMMC compliant?” Leadership teams should also be asking: “What technology foundation do we want to have five years from now, and how can today’s compliance investment help us build it?” That is a very different conversation.

CMMC Could Become a Catalyst

Admittedly, there is a legitimate concern that CMMC will place significant financial and operational pressure on smaller defense suppliers. For example, some companies may decide the cost of compliance is too high. Others may struggle with the resources, expertise and technology required to meet the standards.

However, there is another possibility. For companies that make the investment, CMMC could become a catalyst for modernization that would otherwise have taken years to undertake.

In short, the companies that approach compliance strictly as an audit may finish the assessment and move on. The companies that approach it as an opportunity to modernize their technology foundation may come out of the process with something more valuable: an infrastructure capable of supporting the next generation of manufacturing. That distinction could become increasingly important as AI moves from experimentation into everyday operations.

The Bigger Shift

Of course, the defense industry isn’t going to become an AI industry overnight. Nor should it.

Furthermore, in highly regulated manufacturing, trust has to come before autonomy. Governance has to come before action. And the underlying data has to be reliable before software can be trusted to act on it.

Nevertheless, that doesn’t mean defense manufacturers are behind the AI curve. In some ways, the opposite may be true. In fact, the rigorous controls being demanded today could create an environment where AI can eventually be deployed with greater confidence.

Ultimately, that may be the unexpected consequence of CMMC. What began as a cybersecurity mandate could become a forcing function for technology modernization and, ultimately, a foundation for a more intelligent, more automated defense manufacturing ecosystem.

With the certification timeline under review, it would be easy for defense manufacturers to treat modernization as something that can wait. Ultimately, the more useful question is whether they will use the modernization these requirements still demand to prepare for what comes next.