Unified Defense Stack: A New Standard for Defense and Military Software

Unmanned systems, electronic warfare and intelligence tools, command-and-control systems, Edge AI, and autonomous platforms constantly receive new algorithms, capabilities, and vulnerability fixes. Software increasingly determines the effectiveness of weapons and military technology and their ability to adapt to new threats.

While military hardware modernization once took years, today software for defense systems may need to be updated within days, hours, and sometimes even minutes. This creates a new challenge for organizations involved in defense software development: how can military applications be delivered quickly without compromising cybersecurity, compliance, or operational reliability?

Building such systems requires not only application engineering but also robust software design and development practices adapted to distributed, resource-constrained, and mission-critical environments. Traditional DevOps and CI/CD, however, were built primarily for commercial cloud environments with reliable Internet access. Defense systems operate under very different conditions. They may run in isolated networks, function without Internet access, operate across different classification levels, and face strict cybersecurity requirements. As a result, even a relatively simple military software update can turn into a long process involving reviews, approvals, security checks, and manual audits.

To address these challenges, Defense Unicorns created the Unified Defense Stack (UDS).

Defense Unicorns is a U.S.-based company founded in 2021 by former U.S. military officers. Its team brings extensive experience in national security and defense technology. From the beginning, the company has focused on building software solutions for the defense sector, including complex, classified, and highly regulated environments. Rather than simply adapting commercial technologies for military use, Defense Unicorns aims to change long-established processes for developing, securing, and delivering software across the defense sector.

The company has raised more than $171 million in venture funding and built a team of more than 180 specialists. It works with government defense organizations as well as commercial companies supporting military programs. One of its best-known products is Zarf, an open-source tool for packaging and deploying software into air-gapped, constrained, and standalone environments. Zarf makes it possible to include applications and their required dependencies in a portable package so that software can be deployed even when external Internet access is unavailable.

But Zarf is only part of a larger defense software ecosystem. Today, the company’s core platform is Unified Defense Stack.

Unified Defense Stack (UDS) is a secure, portable, airgap-native platform designed to standardize the military software lifecycle — from application preparation and security validation to packaging, deployment, updates, and ongoing operations. It is not simply a Kubernetes distribution, container registry, or conventional DevSecOps pipeline. UDS brings multiple parts of the software delivery process together within one environment.

The platform covers:

• DevSecOps automation;
• software supply-chain security;
• compliance validation;
• container management;
• package management;
• secure software delivery;
• deployment into isolated and air-gapped networks.

As a result, developers, administrators, cybersecurity teams, and military operators can work under a consistent set of rules regardless of where the software is ultimately deployed. For organizations developing defense IT solutions, this standardization can reduce much of the operational complexity involved in moving applications from development environments to military systems.

UDS can be deployed in developer environments, software management centers, field headquarters, and other defense infrastructure. A developer creates an application package, which is then cryptographically signed. Once signed, unauthorized changes to the package can be detected because modification breaks the integrity of the signature. This helps reduce the risk of software tampering and supply-chain attacks — critical concerns in modern military software development.

When a package enters the UDS software-delivery workflow, it can go through processes such as:

• dependency analysis;
• vulnerability scanning;
• Software Bill of Materials generation;
• security policy checks;
• creation of compliance evidence.

Once a package passes the required checks, it can be made available for deployment and reused across compatible environments. If an application has been prepared for one UDS environment, the same package can be deployed to another compatible environment, provided the target system has the necessary computing resources.

This reduces the need to rebuild and adapt defense sector software independently for every deployment. After installation, security controls, monitoring, configuration, and application lifecycle management continue at the platform level.

UDS consists of several components that work together as an integrated environment for secure defense software delivery.

UDS Core

UDS Core is the open-source foundation of the platform. It provides shared services such as identity, networking, logging, monitoring, and runtime security with hardened defaults. These components are integrated so administrators do not have to manually assemble every part of the infrastructure themselves. UDS Core builds on Kubernetes, the open-source orchestration platform widely used to deploy and manage containerized applications. The goal is to provide a repeatable foundation on which applications can operate under consistent security and infrastructure policies.

UDS Registry

UDS Registry provides centralized management of software artifacts used across UDS environments. The registry can maintain software packages together with security-related information such as vulnerability data and Software Bills of Materials. For organizations operating large portfolios of military software solutions, this creates a central point for understanding what software is available, which versions are being used, and what security information is associated with those artifacts.

UDS Packages

UDS Packages use Zarf-based packaging mechanisms to bundle applications with the dependencies, configuration, and metadata required for deployment. These packages can deliver not only applications but also other digital assets required by mission systems. The same principle can be applied to resources such as terrain data, models, configuration packages, or other software-dependent operational assets.

Zarf and UDS CLI

Zarf and UDS CLI are used to create, inspect, and deploy packages, including in environments without Internet access. Developers can define in advance which parameters operators are allowed to change during installation. This moves much of the technical complexity into the preparation stage, lowering the risk of configuration errors and making deployment easier for personnel operating systems in the field.

Container Image Hardening

UDS supports hardened container images with a reduced attack surface. Container hardening is particularly important in the defense sector because unnecessary software components and dependencies can increase the number of potential vulnerabilities inside a system. Different UDS Core variants can also use different image sources and hardening postures while retaining the same platform configuration model.

UDS UI and Vulnerability Visibility

UDS provides visibility into the state of applications, infrastructure, configurations, and security information. Different groups — administrators, operators, developers, and cybersecurity teams — can access the information relevant to their responsibilities.

UDS Fleet

UDS Fleet extends the platform toward centralized management of distributed UDS installations. A headquarters or central engineering team can use this approach to gain visibility into software deployed across multiple environments rather than managing each installation as a completely separate platform. For the defense sector, this matters because military software may ultimately need to operate across a large number of geographically distributed systems at the tactical edge.

A Common Environment Across Different Military Platforms

One of the main advantages of UDS is infrastructure standardization. Traditionally, an application that worked in one defense environment might fail in another or require significant additional engineering work.

UDS provides a common software-delivery foundation across different platforms. Applications can be packaged in a predictable format and moved between compatible UDS environments. This can reduce the need for separate specialist teams to rebuild deployment processes for every individual platform and make it easier to scale software across the defense sector.

Automated Security Checks and Compliance

Security is a fundamental requirement for any software developed for defense and military systems. UDS Core takes a layered defense-in-depth approach to security, including software supply-chain controls, vulnerability and SBOM information, air-gap readiness, identity management, network security, admission control, runtime security, observability, and auditability.

A Software Bill of Materials (SBOM) provides an inventory of components contained within a software product. SBOMs have become an important part of modern software supply-chain risk management because they help organizations understand what components are present and respond more efficiently when vulnerabilities are discovered. Automating this evidence can reduce manual security work and simplify audits. Full compliance, however, always depends not only on technology but also on an organization’s security processes, policies, risk model, and authorization requirements.

Working in the Cloud and Without Internet Access

Modern defense IT solutions must often operate in environments where reliable connectivity cannot be assumed. This is also a fundamental challenge in military and public safety edge computing, where systems may need to continue processing data and running applications in remote, contested, low-bandwidth, or disconnected environments.

UDS was designed with disconnected operation in mind. Its Zarf-based packaging model allows software and required dependencies to be prepared before deployment, making it possible to move applications into networks that cannot access external repositories. At the same time, UDS is not limited to air-gapped infrastructure. The same principles can be used in conventional cloud, on-premises, and edge environments.

Most commercial cloud products are difficult to adapt to fully disconnected environments because their architecture assumes permanent access to external services. UDS takes the more difficult scenario into account from the beginning.

Multiple Security and Classification Environments

Defense infrastructure may span multiple organizations, networks, mission environments, and classification levels. Each of these environments may require its own controls and isolation boundaries. A standardized software-delivery model can simplify management by allowing common security and deployment practices to be applied while preserving the separation required between individual systems.

Reducing the Vulnerability Surface

Hardened container images, dependency analysis, vulnerability scanning, security policies, and continuous monitoring can reduce the attack surface of military applications. This is particularly important for military software, where compromised components can affect operational systems rather than conventional enterprise applications alone.

The goal is not simply to find more vulnerabilities. It is to establish a controlled software supply chain in which organizations understand what is being deployed, where it comes from, what dependencies it contains, and whether the artifact has changed.

Most DevSecOps solutions were originally designed for commercial cloud environments.

They often assume:

• persistent Internet connectivity;
• access to external repositories;
• centralized cloud infrastructure;
• relatively predictable deployment environments;
• conventional enterprise update processes.

Defense software platforms need to operate under a different set of assumptions. The network may be isolated. Every package may need to be verified. External repositories may be inaccessible. The software supply chain must remain under control. Updates may need to reach systems operating far from conventional IT infrastructure. At the edge, DevOps practices must therefore account for distributed infrastructure, connectivity limitations, automated deployment, remote monitoring, update management, and recovery.

UDS moves much of this complexity away from the final deployment environment and into application preparation, packaging, and validation. As a result, deploying an approved package in the field does not necessarily require the same engineering work that was required to build and validate it. This model speeds up updates, reduces the risk of human error, and makes it possible to scale defense software solutions without requiring a proportional increase in specialist staff at every deployment location.

The same principle applies to automated maintenance at scale: distributed systems need controlled updates, monitoring, diagnostics, and remediation processes without requiring engineers to manually maintain every individual node.

Defense Unicorns has demonstrated UDS across a range of defense environments — from development infrastructure and classified networks to systems operating without persistent connectivity. One example is its work around continuous software delivery for military aircraft, including the F-22. The objective is to reduce the friction between an approved software release and the point at which that software becomes available to mission systems.

The underlying concept is straightforward: developers release a new version, software passes the required security and approval processes, and the resulting package can be moved toward an operational environment without depending on the public Internet at the final point of deployment. This illustrates an important change in modern military technology. Aircraft, unmanned platforms, command-and-control systems, sensors, and other defense technologies increasingly depend on software capabilities that can evolve much faster than the hardware itself.

Ukraine has become a highly active Defense Tech environment. State-owned organizations, private companies, startups, volunteers, and technology manufacturers are developing software for the Armed Forces of Ukraine, unmanned systems, intelligence platforms, communications solutions, battlefield applications, and other defense technologies. As the number of solutions and suppliers grows, software integration and security become more difficult. New applications need to reach users quickly, but software for defense systems also needs to be validated before deployment into operational environments.

Ukraine therefore faces several challenges simultaneously:

• onboarding new software suppliers quickly;
• maintaining common cybersecurity requirements;
• verifying software packages and dependencies;
• distributing updates rapidly;
• supporting disconnected and low-connectivity environments;
• managing multiple versions of applications;
• scaling systems without requiring large specialist teams at every location.

A standardized platform approach can automate a significant part of this work. UDS provides mechanisms for packaging applications, applying security controls, standardizing infrastructure, and simplifying deployment. This can make it easier to scale military software for the Armed Forces of Ukraine while maintaining stronger control over the software supply chain.

For the broader Ukrainian defense sector, this model can also support a more standardized digital ecosystem around modern weapons and military equipment. That becomes increasingly important as defense platforms combine embedded computing, sensors, communications, AI, and application software. Reliable hardware–software integration is therefore not a secondary engineering task. It can directly affect system-level performance, reliability, latency, power consumption, and operational stability.

In Ukraine, these practices are being developed by Edge Solutions Lab (ESL), which works with software, hardware, AI, DevOps, and edge infrastructure for environments where resilience and autonomous operation are critical. ESL’s work in military and public safety edge computing addresses systems operating under bandwidth limitations, security restrictions, compute constraints, hardware diversity, and disrupted connectivity.

For defense applications that require intelligent processing directly at the tactical edge, ESL also works with AI and LLM deployment at the edge, including architectures designed for distributed and resource-constrained environments. Importantly, integrating and adapting technology for Ukrainian defense requirements also creates an opportunity to keep critical engineering expertise inside the country and develop capabilities that reflect local operational needs.

Modern weapons and military equipment are increasingly software-defined. This means the competitiveness of the defense sector depends not only on developing new aircraft, unmanned systems, sensors, electronic warfare systems, communications equipment, or other military technology.

It also depends on how quickly organizations can:

• develop new defense software;
• test and validate it;
• meet cybersecurity requirements;
• securely distribute updates;
• deploy applications into disconnected environments;
• maintain software across different military platforms;
• react to newly discovered vulnerabilities;
• scale new capabilities across operational systems.

Many of these systems also depend on edge computing, where computation and data processing take place at or near the point of operation rather than relying entirely on centralized cloud infrastructure. For military systems, that distinction is especially important.

A cloud application can often assume that connectivity will return quickly. A tactical system may need to continue operating when connectivity is degraded, disrupted, intentionally denied, or completely unavailable. As software becomes more deeply integrated into weapons and military equipment, secure software delivery itself becomes part of defense infrastructure.

Modern defense systems depend on more than hardware. Weapons, unmanned systems, aircraft, intelligence platforms, command-and-control infrastructure, and other military technologies increasingly rely on military software that must evolve continuously. For companies and government organizations involved in defense software development, the challenge is therefore not simply to create better applications. They also need to deliver new software versions, algorithms, security patches, and mission capabilities quickly, reliably, and at scale.

Unified Defense Stack provides a common foundation for developing, validating, packaging, deploying, and updating defense sector software. It reduces manual work, supports operation in isolated networks, strengthens software supply-chain controls, and allows different systems to be managed under a more consistent set of rules.

For Ukraine, this model is particularly relevant. The country already has a rapidly developing Defense Tech ecosystem. The next challenge is not only to create more military software and defense technology, but to build the infrastructure needed to validate, distribute, maintain, and update those solutions securely across operational systems.

Summarizing the importance of such platforms for modern warfare, Volodymyr Kondratenko, CEO of Edge Solutions Lab, says:

“In modern warfare, the advantage does not go to the side that develops new software faster, but to the one that can deliver it to combat systems faster, more securely, and at scale. Unified Defense Stack offers exactly this model — one in which secure software delivery becomes a strategic capability of a defense state.”