By Mike Scopa, SVP of Engineering at Deltek and one of Executive Mosaic’s GovCon Experts
Government contractors are used to managing risk that shows up on a spreadsheet: cost overruns, schedule slips, perhaps a compliance finding on an audit. But the 17th Annual Deltek GovCon Clarity Study, based on survey responses from 917 contractors, points to a different category of risk. It’s the kind of risk that builds quietly inside the systems contractors use to run their business before it ever gets to a program review.
Margins fell from 20 percent to 17 percent this year, even as revenue grew roughly 15 percent. Ninety percent of firms reported at least one declining financial metric. Those numbers describe an industry that is growing and losing ground on profitability at the same time, and a big part of that gap traces back to how contractors’ underlying technology is built, integrated and managed.
As contractors face rising compliance costs, FAR changes and growing demands for FedRAMP-authorized cloud and responsible AI, the Potomac Officers Club’s 2026 FedCiv Summit on Oct. 29 will bring civilian agency leaders and industry together to discuss modernization priorities. Register now!
Where Hidden Risk Hides in Your GovCon Technology Stack
Most contractors would say they have a handle on project risk. The Clarity data tells a more complicated story.
Contractors ranked identifying and mitigating project risk as their top concern for the year, and in 2025, 27 percent of projects still ran over budget, and 26 percent ran behind schedule. And part of that reason is structural. Across the industry, 85 percent of firms manage a single project across two to five separate tools, and only 5 percent operate on a fully integrated system. Scheduling, budgeting, resource management and risk tracking often live in different places entirely. These fragmented systems make it harder to prevent risk.
That fragmentation shows up most clearly in Earned Value Management, which many contractors are subject to either by contract requirement or internal practice. EVM depends on integrated cost, schedule and performance data to function as an early-warning system. When that data sits in disconnected tools, EVM tends to become a reporting exercise rather than the signal it’s designed to be.
The same pattern shows up in risk management timing. Risk analysis is usually done at the proposal stage or during execution. Only 9 percent of contractors manage risk continuously across the full project lifecycle. The result (for that other 91 percent) is a system that catches risk when it’s cheapest to fix and loses visibility when the stakes get higher. Roughly three-quarters of firms report that project-level risks escalate to affect enterprise performance at least some of the time. Their systems weren’t built to show that the risk was never really contained at the project level.
How Software Quality Protects Margin in a Tightening Market
Margin compression is now the defining financial story in GovCon. Ninety-six percent of contractors expect compliance costs to hold steady or increase in the coming year, and 83 percent missed opportunities in 2025 simply because they identified them too late. Neither of those numbers is really about strategy. Both point back to systems.
Consider the KPI data from Clarity: the most valued metrics in 2025 were actual versus planned cost, on-time delivery and resource utilization. Those are the right things to track. But tracking a metric and acting on it in time to change an outcome are two different capabilities, and the gap between them is often largely a software problem. A KPI that surfaces after a reporting period closes documents what already happened. A KPI built into a system that flags the variance in real time gives a program manager the chance to correct course while it still matters.
The top-performing firms tend to be the ones that can see cost, schedule and risk together and act on what they see before it compounds. In a market where margin has already thinned from 20 percent to 17 percent, the difference between reactive reporting and real-time visibility is no longer a nice-to-have. It’s the margin itself.
Why Secure Cloud Architecture Matters So Much for GovCons in 2026
Compliance and data security have moved from a periodic concern to a constant one. The changes pop up with nearly every news cycle. For example, while CMMC Phase 2 has been temporarily suspended, contractors are still subject to DFARS 252.204-7012, which is designed to protect sensitive information. For another, changes to the FAR are causing more execution risk to shift from the government to the contractor.
A cloud platform that can demonstrate FedRAMP Moderate Authorization or Equivalency, and that builds continuous monitoring into its operations rather than treating security as a point-in-time assessment, gives contractors a foundation that can absorb new requirements as they arrive. A platform that can’t do that turns every regulatory change into a potential big problem.
There’s also a connection to AI that contractors are only starting to reckon with. AI-enabled workflows depend on modern architecture, accessible data and clean integration patterns to function reliably. Legacy systems held together with custom, non-API integrations can’t support that kind of capability without a heavy lift first. Contractors must be addressing their legacy systems as a part of developing more modern workflows.
What Responsible AI Means for GovCon Software & What Happens If Contractors Skip It
AI adoption in GovCon has moved fast. Ninety percent of contractors now use AI in some capacity, up from 45 percent just a year earlier, and 92 percent report using generative AI tools specifically.
At the same time, though, firms are still behind on creating mature, fully developed strategies. Only five percent of firms describe their AI capabilities as fully developed, and only about a quarter have established or advanced AI governance in place. The rest are still building the framework for adoption.
That gap is showing up in how project and risk management teams talk about AI: 94 percent of project managers report concerns about using AI in this context, most often citing inaccurate forecasts or risk assessments, difficulty explaining or defending an AI-generated recommendation and reduced human oversight in risk decisions. And of course, data privacy and security remain top AI concerns.
Responsible AI in a GovCon context means being able to explain why an AI-generated pricing recommendation or risk score came out the way it did, in terms a contracting officer or auditor will accept. It means keeping a human in the loop on decisions that carry compliance or contractual weight, rather than treating AI output as a final answer. And it means governance that scales with adoption instead of trailing behind it, since the gap between contractors with mature AI governance and those without is likely what will separate top performers from the rest.
Practical Steps for Creating More Secure Systems
Across this piece, we’re arriving at the same conclusion from several angles. Fragmented systems create project risk that goes unnoticed until it shows up elsewhere in the business. Secure, FedRAMP-authorized cloud architecture is now the foundation that lets contractors meet new compliance requirements as they arrive. And AI adoption has outpaced AI governance, leaving most contractors exposed in ways they haven’t even discovered yet.
I’ll leave you with three actions to take to protect your firm’s systems and reduce some of these hidden risks:
1. Audit where your project data actually lives. If your cost, schedule and risk data are in separate systems that don’t connect with each other, you’re not managing risk continuously, no matter what your process documentation says.
2. Before evaluating any new cloud platform, confirm its FedRAMP Moderate status and ask how continuous monitoring is actually built into the environment.
3. Develop a mature AI governance plan. In a market where compliance costs are already rising and margin is already thin, an AI recommendation that a contractor can’t explain or defend is more of a liability than the efficiency gain it was supposed to be.
