Skip to content
Federal
Capability statementContact

Capabilities · NAICS 541511 · 541512 · 541519 · 541715 · 611420

What we do

Six capabilities, each backed by systems in production today. NAICS codes are listed with each one.

NAICS 541511 · 541512

Custom software development and systems integration

We build web platforms that carry a mission workload: intake, eligibility, case management, payment, scheduling, notification and reporting, with the integrations that make them useful.

  1. 144 API route handlers, 50 screens and 52 database tables in one production system, with a published OpenAPI contract covering 127 paths
  2. 22 unattended business processes on schedules ranging from every minute to monthly
  3. Financial webhooks that verify their signature, log the full payload before processing, and short-circuit duplicates against an immutable event ledger
  4. A custom embedded payment flow built from 19 distinct processor API calls, including installment plans tracked invoice by invoice
  5. Eligibility verification at the point of transaction, checked server-side against a separate system of record with an explicit timeout
Federal fitApplicant intake and eligibility screening, benefits and grants case management, training administration, e-payment collection, constituent notification.
NAICS 541512

Legacy application modernization and data migration

Modernization fails in the cutover, so we design for the cutover first.

  1. A platform moved, not rewritten: nine Java services and an Angular front end came off a single hand-deployed server onto Kubernetes with no application source rewritten. The new stack's first commit and the old stack's last are three days apart, so it was proven before it was trusted. It then ran five more years.
  2. A framework arc readable in the code: Spring Boot 2.1.9 on Java 8 in 2019, to 2.6.6 in 2022, to 3.4.3 on Java 17 in 2025. Four Angular major versions crossed in a live application in three days.
  3. Migrations that reconcile before they move: 27,987 records matched read-only first, with 3,030 deliberately routed to human review, and 76,401 of 76,562 lead records matched at 99.79%
  4. A live run moved 20,299 enrollments to 20,772, deduplicated 13 programs to 7 with zero orphaned keys, and printed its own idempotency check
  5. Parallel run over big bang: cross-platform migration runs as a daily sync through a crosswalk table with uniqueness enforced on both sides
Federal fitApplication modernization, cloud migration, mid-tier replatforming, data migration and reconciliation, system decommissioning.
NAICS 541511 · 541715

AI implementation and governance

We have shipped generative AI since March 2023, and spent the time since learning where it must not be trusted.

  1. Document and contract extraction under a verbatim-evidence rule: every field must carry a quote that appears literally in the source, checked by code, with the page recorded. Across 5,574 contracts, a blind re-extraction of 150 agreed 96.7%.
  2. Record linkage with persisted match method and confidence, where automatic acceptance stops at 0.92 similarity and the uncertain band always goes to a person
  3. Conversational and voice assistants scoped to approved content, with the grading model architecturally unable to see the answer key, and first-word response in 2.0 to 2.7 seconds
  4. Agent access to enterprise systems through five purpose-built connectors exposing 55 tools, each input schema-validated, with a confirmation flag required before any write
Federal fitAI use-case implementation and evaluation, document and claims processing support, improper-payment and reconciliation analytics, AI governance and human-oversight design.
NAICS 541511 · 541519

Engineering excellence: IV&V and test and evaluation

Reliability and technical-debt reduction, measured rather than asserted.

  1. 2,700+ automated regression cases across two production platforms, organized by role and tiered into critical, smoke and full regression
  2. A requirements-to-tests pipeline where each acceptance criterion carries a verbatim quote from the requirement document, verified by a script that substring-searches the source, and reviewed by a separate adversarial checker that never sees the extractor's reasoning
  3. Coverage graded by mutation testing: real defects injected into the code to prove the right test goes red and points at the right requirement line
  4. A test suite that refuses to execute until it proves twice, by two independent methods, that it is not pointed at the production database
  5. Numbered role-boundary tests asserting cross-role access is blocked at the route level
  6. Performance testing at 1,000 concurrent threads in one-hour and twenty-four-hour soak profiles; 45,000 database writes at 100% success under a 500-user simulation
  7. Section 508 conformance work at WCAG 2.0 Level A/AA, with contrast verified by measuring rendered pixels, which caught a real 3.87:1 regression
Federal fitIndependent verification and validation, test and evaluation support, Section 508 testing, regression automation for modernization programs, DevSecOps pipeline gates.
NAICS 541512 · 541519

Secure cloud engineering and DevSecOps

  1. A software factory that existed before the phrase was in the solicitation: 203 CI workflow files and 12 reusable actions. Every pull request provisioned a disposable copy of the entire platform, including clones of all eight databases, applied the request's own schema change to those copies, posted the URL back, and destroyed it on close.
  2. Scanning as a merge gate, not a report: dependency analysis, style and format validation and unit tests all required before a human reviewed the change
  3. Infrastructure as code across four tools, each where it fit: CloudFormation for stateful resources, eksctl for the cluster, Helm for applications, CDK for the serverless identity stack, with Terraform and Ansible in the first generation
  4. Identity at scale: one sign-on federated into 179 downstream applications and workspaces, each with its own role allow-list, with MFA and encrypted session handoff
  5. Security we audit on ourselves: an audit of our own estate found 5 critical and 8 high findings, and the fixes are in the migration history a month later as four named migrations
  6. Defense on public endpoints: four independent gates with forensic logging and indistinguishable responses, built after a dated intrusion attempt, then rebuilt when we measured one gate catching 13 real users out of 13
Federal fitDevSecOps pipeline engineering, cloud migration and operations, ATO evidence preparation, continuous monitoring support, identity and access management.
NAICS 611420

Cyber range and technical workforce development

CYDEO has trained software and security engineers since 2015. The training is not a brochure capability, it is a platform.

  1. A multi-tenant cyber range that hands each learner an isolated, disposable environment in under five seconds, across 41 published lab templates: live Splunk and Wazuh SIEM investigations, six OWASP-class vulnerable-web labs, MITRE ATT&CK-mapped content
  2. Objectives scored automatically against the live environment, with grading scripts executing in a network-isolated, capability-dropped sandbox built on the assumption that a content-author account may be compromised
  3. Seven-role access model, per-tenant isolation and per-organization single sign-on
  4. A learning platform at 344 courses, 27,397 lessons and 1.68 million recorded learner activities, with a self-hosted sandbox that generated and verified 426 coding exercises with 1,677 test cases in a single pipeline run
  5. 150 hours of recorded instruction converted into a machine-checkable competency rubric where 422 citations verify verbatim against the transcript
Federal fitCyber-range and hands-on training delivery, SOC analyst development, DoD 8140 and NICE-aligned competency programs, workforce reskilling, credentialing systems.
Next step

See the work behind these claims

Read the case studiesContracting information