Category: Palantir

Defence Tech at Risk: Palantir, Anduril, and Govini in the New AI Arms Race

Defence Tech at Risk: Palantir, Anduril, and Govini in the New AI Arms Race

A Chink in Palantir and Anduril’s Armour? Govini and Others Are Unsheathing the Sword

When Silicon Valley Code Marches to War

A U.S. Army Chinook rises over Gyeonggi Province, carrying not only soldiers and equipment but streams of battlefield telemetry, encrypted packets of sight, sound and position. Below, sensors link to vehicles, commanders to drones, decisions to data. Yet a recent Army memo reveals a darker subtext: the very network binding these forces together has been declared “very high risk.”

The battlefield is now a software construct. And the architects of that code are not defence primes from the industrial era but Silicon Valley firms, Anduril and Palantir. For years, they have promised that agility, automation and machine intelligence could redefine combat efficiency. But when an internal memo brands their flagship platform “fundamentally insecure,” the question is no longer about innovation. It is about survival.

Just as the armour shows its first cracks, another company, Govini, crosses $100 million in annual recurring revenue, sharpening its own blade in the same theatre.

When velocity becomes virtue and verification an afterthought, the chink in the armour often starts in the code.

The Field Brief

  • A U.S. Army CTO memo calls Anduril–Palantir’s NGC2 communications platform “very high risk.”
  • Vulnerabilities: unrestricted access, missing logs, unvetted third-party apps, and hundreds of critical flaws.
  • Palantir’s stock drops 7 %; Anduril dismisses findings as outdated.
  • Meanwhile, Govini surpasses $100 M ARR with $150 M funding from Bain Capital.
  • The new arms race is not hardware; it is assurance.

Silicon Valley’s March on the Pentagon

For over half a century, America’s defence economy was dominated by industrial giants, Lockheed Martin, Boeing, and Northrop Grumman. Their reign was measured in steel, thrust and tonnage. But the twenty-first century introduced a new class of combatant: code.

Palantir began as an analytics engine for intelligence agencies, translating oceans of data into patterns of threat. Anduril followed as the hardware-agnostic platform marrying drones, sensors and AI decision loops into one mesh of command. Both firms embodied the “move fast” ideology of Silicon Valley, speed as a substitute for bureaucracy.

The Pentagon, fatigued by procurement inertia, welcomed the disruption. Billions flowed to agile software vendors promising digital dominance. Yet agility without auditability breeds fragility. And that fragility surfaced in the Army’s own words.

Inside the Memo: The Code Beneath the Uniform

The leaked memo, authored by Army CTO Gabriele Chiulli, outlines fundamental failures in the Next-Generation Command and Control (NGC2) prototype, a joint effort by Anduril, Palantir, Microsoft and others.

“We cannot control who sees what, we cannot see what users are doing, and we cannot verify that the software itself is secure.”

The findings are stark: users at varying clearance levels could access all data; activity logging was absent; several embedded applications had not undergone Army security assessment; one revealed twenty-five high-severity vulnerabilities, while others exceeded two hundred.

Translated into security language, the platform lacks role-based access control, integrity monitoring, and cryptographic segregation of data domains. Strategically, this means command blindness: an adversary breaching one node could move laterally without a trace.

In the lexicon of cyber operations, that is not “high risk.” It is mission failure waiting for confirmation.

Inside the Memo: The Code Beneath the Uniform

The leaked memo, authored by Army CTO Gabriele Chiulli, outlines fundamental failures in the Next-Generation Command and Control (NGC2) prototype — a joint effort by Anduril, Palantir, Microsoft and others.

“We cannot control who sees what, we cannot see what users are doing, and we cannot verify that the software itself is secure.”

-US Army Memo

The findings are stark: users at varying clearance levels could access all data; activity logging was absent; several embedded applications had not undergone Army security assessment; one revealed twenty-five high-severity vulnerabilities, while others exceeded two hundred.

Translated into security language, the platform lacks role-based access control, integrity monitoring, and cryptographic segregation of data domains. Strategically, this means command blindness: an adversary breaching one node could move laterally without trace.

In the lexicon of cyber operations, that is not “high risk.” It is a “mission failure waiting for confirmation”.

The Doctrine of Velocity

Anduril’s rebuttal was swift. The report, they claimed, represented “an outdated snapshot.” Palantir insisted that no vulnerabilities were found within its own platform.

Their responses echo a philosophy as old as the Valley itself: innovation first, audit later. The Army’s integration of Continuous Authority to Operate (cATO) sought to balance agility with accountability, allowing updates to roll out in days rather than months. Yet cATO is only as strong as the telemetry beneath it. Without continuous evidence, continuous authorisation becomes continuous exposure.

This is the paradox of modern defence tech: DevSecOps without DevGovernance. A battlefield network built for iteration risks treating soldiers as beta testers.

Govini’s Counteroffensive: Discipline over Demos

While Palantir’s valuation trembled, Govini’s ascended. The Arlington-based startup announced $100 million in annual recurring revenue and secured $150 million from Bain Capital. Its CEO, Tara Murphy Dougherty — herself a former Palantir executive — emphasised the company’s growth trajectory and its $900 million federal contract portfolio.

Govini’s software, Ark, is less glamorous than autonomous drones or digital fire-control systems. It maps the U.S. military’s supply chain, linking procurement, logistics and readiness. Where others promise speed, Govini preaches structure. It tracks materials, suppliers and vulnerabilities across lifecycle data — from the factory floor to the frontline.

If Anduril and Palantir forged the sword of rapid innovation, Govini is perfecting its edge. Precision, not pace, has become its competitive advantage. In a field addicted to disruption, Govini’s discipline feels almost radical.

Technical Reading: From Vulnerability to Vector

The NGC2 memo can be interpreted through a simple threat-modelling lens:

  1. Privilege Creep → Data Exposure — Excessive permissions allow information spillage across clearance levels.
  2. Third-Party Applications → Supply-Chain Compromise — External code introduces unassessed attack surfaces.
  3. Absent Logging → Zero Forensics — Breaches remain undetected and untraceable.
  4. Unverified Binaries → Persistent Backdoors — Unknown components enable long-term infiltration.

These patterns mirror civilian software ecosystems: typosquatted dependencies on npm, poisoned PyPI packages, unpatched container images. The military variant merely amplifies consequences; a compromised package here could redirect an artillery feed, not a webpage.

Modern defence systems must therefore adopt commercial best practice at military scale: Software Bills of Materials (SBOMs), continuous vulnerability correlation, maintainer-anomaly detection, and cryptographic provenance tracking.

Metadata-only validation, verifying artefacts without exposing source, is emerging as the new battlefield armour. Security must become declarative, measurable, and independent of developer promises.

Procurement and Policy: When Compliance Becomes Combat

The implications extend far beyond Anduril and Palantir. Procurement frameworks themselves require reform. For decades, contracts rewarded milestones — prototypes delivered, demos staged, systems deployed. Very few tied payment to verified security outcomes.

Future defence contracts must integrate technical evidence: SBOMs, audit trails, and automated compliance proofs. Continuous monitoring should be a contractual clause, not an afterthought. The Department of Defense’s push towards Zero Trust and CMMC v2 compliance is a start, but implementation must reach code level.

Governments cannot afford to purchase vulnerabilities wrapped in innovation rhetoric. The next generation of military contracting must buy assurance as deliberately as it buys ammunition.

Market Implications: Valuation Meets Validation

The markets reacted predictably: Palantir’s shares slid 7.5 %, while Govini’s valuation swelled with investor confidence. Yet beneath these fluctuations lies a structural shift.

Defence technology is transitioning from narrative-driven valuation to evidence-driven validation. The metric investors increasingly prize is not just recurring revenue but recurring reliability, the ability to prove resilience under audit.

Trust capital, once intangible, is becoming quantifiable. In the next wave of defence-tech funding, startups that embed assurance pipelines will attract the same enthusiasm once reserved for speed alone.

The Lessons of the Armour — Ten Principles for Digital Fortification

For practitioners like me (Old school), here are the Lessons learnt through the classic lens of Saltzer and Schroder.

No.Modern Principle (Defence-Tech Context)Saltzer & Schroeder PrinciplePractical Interpretation in Modern Systems
1Command DevSecOps – Governance must be embedded, not appended. Every deployment decision is a command decision.Economy of MechanismKeep security mechanisms simple, auditable, and centrally enforced across CI/CD and mission environments.
2Segment by Mission – Separate environments and privileges by operational need.Least PrivilegeEach actor, human or machine, receives the minimum access required for the mission window. Segmentation prevents lateral movement.
3Log or Lose – No event should be untraceable.Complete MediationEvery access request and data flow must be logged and verified in real time. Enforce tamper-evident telemetry to maintain operational integrity.
4Vet Third-Party Code – Treat every dependency as a potential adversary.Open DesignAssume no obscurity. Transparency, reproducible builds and independent review are the only assurance that supply-chain code is safe.
5Maintain Live SBOMs – Generate provenance at build and deployment.Separation of PrivilegeIndependent verification of artefacts through cryptographic attestation ensures multiple checks before code reaches production.
6Embed Rollback Paths – Every deployment must have a controlled retreat.Fail-Safe DefaultsWhen uncertainty arises, systems must default to a known-safe state. Rollback or isolation preserves mission continuity.
7Automate Anomaly Detection – Treat telemetry as perimeter.Least Common MechanismShared services such as APIs or pipelines should minimise trust overlap. Automated detectors isolate abnormal behaviour before propagation.
8Demand Provenance – Trust only what can be verified cryptographically.Psychological AcceptabilityVerification should be effortless for operators. Provenance and signatures must integrate naturally into existing workflow tools.
9Audit AI – Governance must evolve with autonomy.Separation of Privilege and Economy of MechanismMultiple models or oversight nodes should validate AI decisions. Explainability should enhance, not complicate, assurance.
10Measure After Assurance – Performance metrics follow proof of security, never precede it.Least Privilege and Fail-Safe DefaultsPrioritise verifiable assurance before optimisation. Treat security evidence as a precondition for mission performance metrics.

The Sword and the Shield

The codebase has become the battlefield. Every unchecked commit, every unlogged transaction, carries kinetic consequence.

Anduril and Palantir forged the sword, algorithms that react faster than human cognition. But Govini, and others of its kind, remind us that the shield matters as much as the blade. In warfare, resilience is victory’s quiet architect.

The lesson is not that speed is dangerous, but that speed divorced from verification is indistinguishable from recklessness. The future of defence technology belongs to those who master both: the velocity to innovate and the discipline to ensure that innovation survives contact with reality.

In this new theatre of code and command, it is not the flash of the sword that defines power — it is the assurance of the armour that bears it.

References & Further Reading

  • Mike Stone, Reuters (3 Oct 2025) — “Anduril and Palantir battlefield communication system ‘very high risk,’ US Army memo says.”
  • Samantha Subin, CNBC (10 Oct 2025) — “Govini hits $100 M in annual recurring revenue with Bain Capital investment.”
  • NIST SP 800-218: Secure Software Development Framework (SSDF).
  • U.S. DoD Zero-Trust Strategy (2024).
  • MITRE ATT&CK for Defence Systems.
Innovation Drain: Is Palantir Losing Its Edge In 2025?

Innovation Drain: Is Palantir Losing Its Edge In 2025?

“Innovation doesn’t always begin in a boardroom. Sometimes, it starts in someone’s resignation email.”

In April 2025, Palantir dropped a lawsuit-shaped bombshell on the tech world. It accused Guardian AI—a Y-Combinator-backed startup founded by two former Palantir employees—of stealing trade secrets. Within weeks of leaving, the founders had already launched a new platform and claimed their tool saved a client £150,000.

Whether that speed stems from miracle execution or muscle memory is up for debate. But the legal question is simpler: Did Guardian AI walk away with Palantir’s crown jewels?

Here’s the twist: this is not an isolated incident. It’s part of a long lineage in tech where forks, clones, and spin-offs are not exceptions—they’re patterns.

Innovation Splinters: Why People Fork and Spin Off

Commercial vs Ideological vs Governance vs Legal Grey Zone

To better understand the nature of these forks and exits, it’s helpful to bucket them based on the root cause. Some are commercial reactions, others ideological; many stem from poor governance, and some exist in legal ambiguity.

Commercial and Strategic Forks

MySQL to MariaDB: Preemptive Forking

When Oracle acquired Sun Microsystems, the MySQL community saw the writing on the wall. Original developers forked the code to create MariaDB, fearing Oracle would strangle innovation.

To this day, both MySQL and MariaDB co-exist, but the fork reminded everyone: legal ownership doesn’t mean community trust. MariaDB’s success hinged on one truth—if you built it once, you can build it better.

Cassandra: When Innovation Moves On

Born at Facebook, Cassandra was open-sourced and eventually handed over to the Apache Foundation. Today, it’s led by a wide community of contributors. What began as an internal tool became a global asset.

Facebook never sued. Instead, it embraced the open innovation model. Not every exit has to be litigious.

Governance and Ideological Differences

SugarCRM vs vTiger: Born of Frustration

In the early 2000s, SugarCRM was the darling of open-source CRM. But its shift towards commercial licensing alienated contributors. Enter vTiger CRM—a fork by ex-employees and community members who wanted to stay true to open principles. vTiger wasn’t just a copy. It was a critique.

Forks like this aren’t always about competition. They’re about ideology, governance, and autonomy.

OpenOffice to LibreOffice: Governance is Everything

StarOffice, then OpenOffice.org, eventually became a symbol of open productivity tools. But Oracle’s acquisition led to concerns over the project’s future. A governance rift triggered the formation of LibreOffice, led by The Document Foundation.

LibreOffice wasn’t born because of a feature war. It was born because developers didn’t trust the stewards. As your own LinkedIn article rightly noted: open-source isn’t just about access to code—it’s about access to decision-making.

Elastic, Redis, and Your Fork Writings

In my earlier articles on Elastic’s open-source licensing journey and the Redis licensing shift, I unpacked how open-source communities often respond to perceived shifts in governance and monetisation priorities:

  • Elastic’s licensing changes—primarily to counter cloud hyperscaler monetisation—sparked the creation of OpenSearch.
  • Redis’ decision to adopt more restrictive licensing prompted forks like Valkey, driven by a desire to preserve ecosystem openness.

These forks weren’t acts of rebellion. They were community-led efforts to preserve trust, autonomy, and the spirit of open development—especially when governance structures were seen as diverging from community expectations.

Speculative Malice and Legal Grey Zones

Zoho vs Freshworks: The Legal Grey Zone

In a battle closer to Palantir’s turf, Zoho sued Freshdesk (now Freshworks), alleging its ex-employee misused proprietary knowledge. The legal line between know-how and trade secret blurred. The case eventually settled, but it spotlighted the same dilemma:

When does experience become intellectual property?

Palantir vs Guardian AI: Innovation or Infringement?

The lawsuit alleges the founders used internal documents, architecture templates, and client insights from their time at Palantir. According to the Forbes article, Palantir has presented evidence suggesting the misappropriated information includes key architectural frameworks for deploying large-scale data ingestion pipelines, client-specific insurance data modelling configurations, and a set of reusable internal libraries that formed the backbone of Palantir’s healthcare analytics solutions.

Moreover, the codebase referenced in Guardian AI’s marketing demos reportedly bore similarities to internal Palantir tools—raising questions about whether this was clean-room engineering or a case of re-skinning proven IP.

Palantir might win the case. Or it might just win headlines. Either way, it won’t undo the launch or rewind the execution.

The 72% Problem: Trade Secrets Walk on Two Legs

As Intanify highlights: 72% of employees take material with them when they leave. Not out of malice, but because 59% believe it’s theirs.

The problem isn’t espionage. It’s misunderstanding.

If engineers build something and pour years into it, they believe they own it—intellectually if not legally. That’s why trade secret protection is more about education, clarity, and offboarding rituals than it is about courtroom theatrics.

Palantir: The Google of Capability, The PayPal of Alumni Clout

Palantir has always operated in a unique zone. Internally, it combines deep government contracts with Silicon Valley mystique. Externally, its alumni—like those from PayPal before it—are launching startups at a blistering pace.

In your own writing on the Palantir Mafia and its invisible footprint, you explore how Palantir alumni are quietly reshaping defence tech, logistics, public policy, and AI infrastructure. Much like Google’s former engineers dominate web infrastructure and machine learning, Palantir’s ex-engineers carry deep understanding of secure-by-design systems, modular deployments, and multi-sector analytics.

Guardian AI is not an aberration—it’s the natural consequence of an ecosystem that breeds product-savvy problem-solvers trained at one of the world’s most complex software institutions.

If Palantir is the new Google in terms of engineering depth, it’s also the new PayPal in terms of spinoff potential. What follows isn’t just competition. It’s a diaspora.

What Companies Can Actually Do

You can’t fork-proof your company. But you can make it harder for trade secrets to walk out the door:

  • Run exit interviews that clarify what’s owned by the company
  • Monitor code repository access and exports
  • Create intrapreneurship pathways to retain ambitious employees
  • Invest in role-based access and audit trails
  • Sensitise every hire on what “IP” actually means

Hire smart people? Expect them to eventually want to build their own thing. Just make sure they build their own thing.

Conclusion: Forks Are Features, Not Bugs

Palantir’s legal drama isn’t unique. It’s a case study in what happens when ambition, experience, and poor IP hygiene collide.

From LibreOffice to MariaDB, vTiger to Freshworks—innovation always finds a way. Trade secrets are important. But they’re not fail-safes.

When you hire fiercely independent minds, you get fire. The key is to manage the spark—not sue the flame.

References

Byfield, B. (n.d.). The Cold War Between OpenOffice.org and LibreOffice. Linux Magazine. Available at: https://www.linux-magazine.com/Online/Blogs/Off-the-Beat-Bruce-Byfield-s-Blog/The-Cold-War-Between-OpenOffice.org-and-LibreOffice

Feldman, A. (2025). Palantir Sues Y-Combinator Startup Guardian AI Over Alleged Trade Secret Theft. Forbes. Available at: https://www.forbes.com/sites/amyfeldman/2025/04/01/palantir-sues-y-combinator-startup-guardian-ai-over-alleged-trade-secret-theft-health-insurance/

Intanify Insights. (n.d.). Palantir, People, and the 72% Problem. Available at: https://insights.intanify.com/palantir-people-and-the-72-problem

PACERMonitor. (2025). Palantir Technologies Inc v. Guardian AI Inc et al. Available at: https://www.pacermonitor.com/public/case/57171731/Palantir_Technologies_Inc,_v_Guardian_AI,_Inc,_et_al

Sundarakalatharan, R. (2023). Elastic’s Open Source Reversal. NocturnalKnight.co. Available at: https://nocturnalknight.co/why-did-elastic-decide-to-go-open-source-again/

Sundarakalatharan, R. (2023). Inside the Palantir Mafia: Secrets to Succeeding in the Tech Industry. NocturnalKnight.co. Available at: https://nocturnalknight.co/inside-the-palantir-mafia-secrets-to-succeeding-in-the-tech-industry/

Sundarakalatharan, R. (2024). The Fork in the Road: The Curveball That Redis Pitched. NocturnalKnight.co. Available at: https://nocturnalknight.co/the-fork-in-the-road-the-curveball-that-redis-pitched/

Sundarakalatharan, R. (2024). Inside the Palantir Mafia: Startups That Are Quietly Shaping the Future. NocturnalKnight.co. Available at: https://nocturnalknight.co/inside-the-palantir-mafia-startups-that-are-quietly-shaping-the-future/

Sundarakalatharan, R. (2023). Open Source vs Open Governance: The State and Future of the Movement. LinkedIn. Available at: https://www.linkedin.com/pulse/open-source-vs-governance-state-future-movement-sundarakalatharan/

Inc42. (2020). SaaS Giants Zoho And Freshworks End Legal Battle. Available at: https://inc42.com/buzz/saas-giants-zoho-and-freshworks-end-legal-battle/

ExpertinCRM. (2019). vTiger CRM vs SugarCRM: Pick a Side. Medium. Available at: https://expertincrm.medium.com/vtiger-crm-vs-sugarcrm-pick-a-side-4788de2d9302

Bitnami