Against drones, DHS writes two lists. Anduril makes only one

On 5 August 2026 the Department of Homeland Security announced a $1.5 billion framework contract against hostile drones, with twelve companies admitted across two distinct lists. The first sells detection and neutralisation hardware and software: the customer buys it, installs it, and owns it. The second sells the same outcome — detect, track, neutralise a drone — as a managed service, without the buying agency ever owning the equipment. Anduril Industries, among the best-known names in counter-drone systems, made only the second list. On 12 August it filed a protest with the Government Accountability Office to be admitted to the first as well. The protest is not yet decided — legal deadline 20 November — but the question it opens concerns anyone buying this capability: same company, same product, two radically different legal relationships.

The facts, from public documents

The official release — “DHS Announces Contract Awards to Strengthen Department-Wide CUAS Capabilities,” issued on 5 August 2026 by the Science and Technology Directorate — explains the goal: giving DHS Components “a common pathway” to acquire detection, tracking, identification and mitigation capabilities against unauthorised drones, historically bought separately by each Component. Secretary Markwayne Mullin, quoted in the release: “These awards mark an important step in strengthening DHS’s ability to respond to unauthorized and malicious unmanned aircraft systems. By taking a Department-wide approach, we are improving mission readiness, supporting more consistent capabilities, and helping ensure DHS personnel have access to the right tools for the job.”

The release does not list the companies or describe the two tracks: that level comes from procurement documents picked up by the trade press, Inside Unmanned Systems and FedScoop among others. The vehicle, five years, ordering open from 1 August 2026 to 31 July 2031, splits into two Tracks. Track 1 — hardware, software and ancillary services — has a ceiling just above $1 billion and went to seven companies: Dedrone Defense, D-Fend Solutions AD, Leidos, Fortem Technologies, CACI Inc.-Federal, BAE Systems Technology Solutions & Services and EMS Defense Technologies. Track 2 — comprehensive services, capability delivered, verbatim per FedScoop, as a “fully managed service,” plus system integration and support for research and testing — has a ceiling of roughly $489 million and went to Booz Allen Hamilton, General Dynamics IT, Parsons Government Services, BAE Systems Technology Solutions & Services, Leidos, Astrion Group and Anduril Industries. Only Leidos and BAE appear on both lists; the other ten, Anduril included, hold a single spot. The system must — per the statement of work cited by Inside Unmanned Systems — detect a drone at a minimum of 2 km, track at least three simultaneously, and neutralise a threat at a minimum of 500 metres.

The protest

Anduril won a spot on Track 2, none on Track 1, despite bidding for both: “Anduril is challenging DHS’ evaluation of its proposal and argues that it should have received awards for both tracks of the five-year C-UAS vehicle” — Anduril, Washington Technology writes, is disputing DHS’s evaluation of its bid and contends it should have won a spot on both lists. The protest was filed on 12 August with the GAO, against solicitation 70RDA226R00000001; a decision is due by 20 November 2026. Sources disagree on the number of bids received — 47 in total per Inside Unmanned Systems, 57 on Track 1 and 47 on Track 2 per Washington Technology — a discrepancy neither explains: GAO case files are not public before a ruling, as already noted for another protest against the same agency.

Who Anduril is, and why the distinction matters

Anduril was founded in 2017 in Costa Mesa, California; its first product, the Sentry surveillance tower, was already a detection system — the same function at the heart of this contract. It is a private company, under no obligation to file 8-Ks or 10-Qs, as already noted regarding another arrangement disclosed without a public contract. These are two different legal relationships at equal technical outcome: in the first, the customer owns the equipment, and whoever sold it answers directly; in the second, the customer buys a continuing service, and whoever owes it is the integrator that signed — not necessarily whoever built the hardware inside it. A DHS Component wanting to buy, as owned property, an Anduril system through this vehicle would find no such route on Track 1: it could only buy a managed service from Anduril. That is the gap the protest asks to close, and one that meanwhile stays open for anyone deciding who to buy from, and under what obligations owed by whom.

See the service · Talk to an engineer

What we don’t know

We don’t know the specific legal grounds of the protest: the GAO does not publish pre-decision case files, only the outcome. We don’t know whether Track 1 winners can build Anduril hardware into their own offerings, nor whether Anduril, on its own Track 2, subcontracts third-party hardware: no public document says so. We don’t know what happens to a Track 2 order once it ends — whether the Component keeps the data and configuration, or starts again with another supplier. It is declared, by the DHS release, that the vehicle’s goal is consistency, interoperability, technology refresh. The spending ceiling per track and the list of winners sit in the procurement documents, which we have not opened: the trade press reports them, and that is where we take them from. The same goes for the protest: the docket number, the filing date and the decision deadline come from the press, while the GAO site refused every attempt we made to consult it on 19 August with a 403 error - so we have not verified them at source. Nowhere in any public record consulted for this article is it declared or filed what happens, contractually, when a “fully managed service” order ends.

The question that matters, for buyers

There is nothing irregular here: splitting a complex purchase into tracks with different admission rules is legitimate procurement, and a protest from a company excluded from one of them is a legal remedy, not an anomaly. The point lies elsewhere. Anyone looking from outside — another public agency, a company assessing a similar supplier, a board of directors — sees a single name, Anduril, attached to a recognisable capability. The framework contract says something more precise: that name, in this vehicle, is authorised to sell only one kind of relationship — a continuing service, not an asset the customer owns — while the same technical outcome, bought from six other suppliers, arrives with the opposite relationship. Which legal entity would a DHS Component enforce a right against if something went wrong with the capability it received, and what would it be left with if it switched suppliers when the order expired? The answer changes depending on which list that capability came from, and no source consulted spells it out in full. The same question applies whenever a critical supplier appears in more than one contractual configuration under the same brand: as seen with Boeing and Archer, where the release and the filing disagreed, and with the investment vehicles bearing the Anduril name without Anduril ever signing them.

The two axes, applied

Compliance. The register of critical capabilities bought from third parties — here, drone detection and neutralisation — stops being a release read once and becomes a control running on the actual contracts: for every order placed against a multi-track vehicle, which Track it originates from, which entity signs it, whether the customer owns the equipment or buys a service, what happens at termination — with a dated trail, ready for an inspection, a tender or a board meeting, the same approach applied to a supplier whose inspections end up inside another system.

Decide. The same system holds contracts, suppliers and procurement records together in a single operating model, on which AI agents execute decisions with a human operator in command — for large enterprises, defence, public administration and healthcare. Always in two modes: on-premises, on self-contained machines requiring no deep integration into the customer’s network, or a dedicated cloud with a private VPN and a data centre in Italy, always with shared management — the same distinction between ownership and service that DHS applies to drones, applied here to the operating model of whoever holds the final decision.

From the first session, at no cost, comes the dated list of critical capabilities you buy from third parties — which legal entity owes them, who controls it, whether you keep ownership or only a service that can end — including the boxes left empty: yours to keep even if we do not go on to work together. Talk to one of our engineers.