Executive Order 14306 — signed June 2025, amending EO 13694 and EO 14144 — directs NIST to finalize an updated Secure Software Development Framework (SP 800-218) and push agencies toward machine-readable, auditable compliance: software bills of materials, attestations, and consolidated shared services like DHS's Continuous Diagnostics and Mitigation (CDM) program. The mechanism is boring but powerful. Every additional vendor in a federal or critical-infrastructure security stack is another attestation to chase, another SBOM to reconcile, another audit surface. Procurement officers facing that paperwork don't reward the best point solution — they reward the fewest vendors. That structural bias toward consolidation is now written into how Washington buys cyber tools, and it reshapes which companies get the renewal.
Washington's Secure-by-Design Mandate Is Quietly Picking Cybersecurity's Winner
EO 14306's push for consolidated, SBOM-verified software supply chains rewards vendors selling one platform over agencies juggling a dozen point tools — and that math favors Palo Alto over CrowdStrike, for now.

A CISO who has to justify eleven separate vendor contracts to an auditor with a software bill of materials checklist has a career incentive to have one vendor and one throat to choke.
Who cashes in:
- PANW (Palo Alto Networks) — Palo Alto has spent five years selling "platformization" (Cortex, Prisma, Strata bundled under single contracts with migration credits) specifically as a hedge against best-of-breed sprawl. An SBOM-and-consolidation mandate is free marketing for a pitch Palo Alto was already making to CISOs: fewer vendors means fewer compliance headaches. Federal and defense-industrial-base renewals are the natural first movers.
- CRWD (CrowdStrike) — Falcon's single-agent architecture is itself a consolidation argument, and the company is racing to close the suite gap. Falcon Flex, its drawdown licensing model, now represents roughly a third of total ARR and is growing over 200% year-over-year, with module adoption (customers running 6+ modules) climbing past 49%. If CrowdStrike converts that momentum into a genuine platform before agencies finalize procurement rules, it keeps its seat at the table instead of losing it to Palo Alto.
- PLTR (Palantir) — Palantir's government relationships and Foundry/Gotham integration work put it in position to be the "consolidation glue" layer agencies hire to unify data across whichever security platform wins, a durable role regardless of the PANW/CRWD outcome.
Who is exposed:
- OKTA (Okta) — identity is the category most at risk of being folded into a bigger suite. Both Palo Alto (Cortex/XSIAM identity threat detection) and CrowdStrike (Falcon Identity Protection) now sell identity security as an add-on module, directly threatening Okta's point-solution position in accounts pursuing vendor reduction.
- S (SentinelOne) — smaller scale means less leverage to become the "one platform" a consolidating agency picks, and every dollar an enterprise redirects to a Falcon Flex or Cortex bundle is a dollar SentinelOne has to fight harder for.
- FTNT (Fortinet) — strong in network/firewall appliances but weaker in the cloud-native, agent-based platform story that SBOM-era procurement favors; risks being read as legacy infrastructure rather than the consolidated stack.
The play: Watch FedRAMP authorization lists and CDM program vendor awards over the next two quarters — that's where the consolidation preference shows up first, before it hits enterprise earnings calls. Zscaler ZS is the wildcard: its SSE architecture could ride the same consolidation wave as a network-security anchor, or get squeezed the same way Okta is if Palo Alto's SASE bundle keeps winning renewals.
Source: original report ↗
Free: catalyst alerts, straight to your inbox.
Get the White House orders, federal contracts, and FDA decisions that move money — with who cashes in — free. Unsubscribe in one click.
Free · weekly · unsubscribe anytime. Privacy.
Stay three moves ahead of every practice in your market.
Knowing it happened is table stakes. Money Racket Pro hands you the play — what each move means for your margins, your license, and your patients, and exactly what to do about it — in a two-minute brief, twice a week. The owners who read it never get blindsided.
Get the edge · $40/moJoin the owners who run ahead of the industry. Cancel anytime, one click.