By Outrider Editorial Team · Updated August 20, 2026
How do you sell to the military?
Register in SAM.gov, then pick a door: open competitions posted on SAM.gov, the Defense Innovation Unit for commercial technology that can be prototyped, or SBIR and STTR for funded R&D. The Department of Defense obligated $491.7 billion in FY2025, and CMMC gates any work touching controlled unclassified information.
The Department of Defense obligated $491.7 billion in prime contracts in fiscal 2025, more than the next nine federal agencies put together. Each of those dollars passed through a contracting officer who had to choose a vendor, and plenty of them went to companies with no defense history at all.
The general path in how to sell to the government still applies here: register once, pick your codes, find the buying office. What changes at DoD is the scale, the compliance floor, and the fact that the department deliberately built side doors for companies without a defense resume.
What the military actually buys
Follow the money and the market stops being abstract.
Aircraft manufacturing (336411) carried $61.2 billion in FY2025 obligations, of which DoD accounted for $60.7 billion. Ship building and repairing (336611) carried $37.2 billion, DoD $36.2 billion. Those are the platforms everyone pictures when they picture defense.
The services side is nearly as large and far more open. Engineering services (541330) carried $52.3 billion, DoD $40.1 billion of it. R&D in the physical, engineering, and life sciences (541715) carried $48.5 billion, DoD $33.1 billion. Across the 120 highest-spending NAICS codes we track, DoD is the number one awarding agency in 85 of them, which is why "who buys this" has such a boring answer in most defense-adjacent categories.
One figure predicts winnability better than any total: the number of awards behind it. Guided missile and space vehicle manufacturing (336414) moved $33.1 billion across 778 contract actions. Search, detection, and navigation instrument manufacturing (334511) moved $18.6 billion across 13,892 of them. Half the dollars, eighteen times the doors. For a thirty-person company, the second market has entry points and the first one mostly does not.
Door one: SAM.gov, the same front door everyone uses
Most DoD requirements are competed in public. Federal agencies must synopsize proposed contract actions expected to exceed $25,000 in the governmentwide point of entry, which is SAM.gov Contract Opportunities (FAR 5.101). Run one saved search per NAICS code and one per PSC code you sell into, because a requirement filed under a service code you never watch is invisible to you.
Then read the Department of Defense guide for the structural point that trips up new vendors: DoD is a coalition of buyers. Every base has a contracting office, every program office spends on its own authority, and no single award gives you the department. The upside of that decentralization is that no single gatekeeper can shut you out either.
Sources Sought notices deserve special attention. They are market research posted before a solicitation exists, and a strong response puts your capability in front of the officer while the requirement is still being drafted. Enough capable small-business responses can also push the eventual buy toward a set-aside.
Door two: DIU, for commercial technology
The Defense Innovation Unit exists because commercial technology outruns the defense acquisition cycle. DIU posts its open solicitations publicly, and the first thing a company submits is a short solution brief; DIU reaches out if it wants to schedule a pitch (diu.mil). DIU states it has already introduced more than 100 first-time vendors to the department.
The commercially important part is what happens after a prototype succeeds. Any interested department entity has the authority to enter a non-competitive follow-on production contract for the prototyped solution (diu.mil). A prototype that works becomes a production path without a fresh competition. Our walkthrough of how a DIU Commercial Solutions Opening works covers the submission mechanics.
Door three: SBIR and STTR, the funded on-ramp
SBIR and STTR are the only doors that pay you to walk through them. The funding is non-dilutive: no equity, no repayment. As of April 2026, agencies may issue a Phase I award up to $323,090 and a Phase II award up to $2,153,927 without seeking SBA approval (sbir.gov). Eleven federal agencies participate, and DoD runs the largest programs among them.
For a company with no defense past performance, this is the cleanest entry in the system, because the proposal is judged on the technical idea and the commercialization case. Our SBIR Phase II playbook covers what reviewers score and where strong technical teams lose, and the free Reviewer Scorecard runs a draft against the disqualifiers before you submit.
The R&D ladder, read through PSC codes
If you sell research, the PSC code on an award tells you which rung of the ladder the money is sitting on, and the rungs are nowhere near equal.
AC11, basic research for DoD military, carried $1.85 billion in FY2025. AC12, applied research, carried $3.79 billion. AC13, experimental development, carried $9.24 billion, roughly five times the basic research pool.
Money concentrates where the work is closest to fielding. That has a direct effect on how you write. A proposal framed as open-ended inquiry reads like AC11 work to an office holding AC13 money, and it loses to a proposal describing the same technology in terms of a demonstration, an operating environment, and a transition target.
CMMC is the gate, and it takes months
Anything that stores, transmits, or processes controlled unclassified information for DoD requires CMMC, including when you sit under a DoD prime as a subcontractor. Level 1 covers 14 basic practices, and our CMMC checklist for small business puts it at $10,000 to $20,000 over four to eight weeks. Level 2 covers more than 110 practices against NIST SP 800-171, runs $40,000 to $80,000 over twelve to sixteen weeks, and requires an assessment by a certified third party that stays valid for three years.
That checklist flags two budget-wrecking failure modes. Documentation is slower than tooling, because proving you performed a control takes longer than deploying it. And CMMC reaches HR, finance, and operations, so a company that files it under IT discovers the gap late. Ask the contracting officer which level a requirement carries before you spend a dollar chasing it.
Prime, sub, or both
A shipbuilding or aircraft award is nobody's first contract. Those programs run through primes, and subcontracting under one puts your technology on a live program while giving you a reference from a company the government already trusts. You pay for that in margin and in customer access, since the prime owns the relationship with the buying office.
Prime contracting starts working earlier than most companies assume once the buy is small, service-shaped, or set aside. Our guide to winning a first contract with no past performance maps the lanes where a new vendor can bid directly.
Live test events are a real channel
Some of the fastest military introductions never begin with a solicitation. Exercises such as ANTX, the Advanced Naval Technology Exercise, and REPMUS, NATO's unmanned and autonomous systems exercise, put working systems in front of operators and program managers under field conditions, and the resulting after-action data is evidence a program office can act on. Outrider builds the event infrastructure behind exercises including ANTX and REPMUS, and our resource directory lists both alongside other demonstration channels.
A demo is not a contract. It is how you become known to the people who write requirements, which is worth more in year one than a polished capability statement nobody asked for.
Where to start this month
- Search your NAICS and PSC codes on SAM.gov and read a year of DoD award notices in each. Winners, prices, and buying offices are all published.
- Compare the DIU open solicitations against what you already sell. The solution brief is short on purpose.
- If the product is still maturing, work the SBIR playbook and target the next DoD topic release.
- Price CMMC before you bid, not after you win.
Frequently Asked
Common questions.
What does the military actually buy?
Hardware leads: aircraft manufacturing carried $61.2 billion in FY2025 obligations and shipbuilding $37.2 billion, with DoD taking almost all of both. Services are close behind and easier to enter. Engineering services carried $52.3 billion and physical and life sciences R&D $48.5 billion, DoD the largest buyer in each.
Do I need CMMC certification before I can bid on DoD work?
You need it before you handle controlled unclassified information for DoD, including as a subcontractor to a DoD prime. Level 1 covers 14 basic practices. Level 2 covers more than 110 and requires a third-party assessment good for three years. Ask the contracting officer which level a specific requirement carries.
Can a company with no defense experience win DoD work?
That is what the Defense Innovation Unit was built for. DIU says it has already introduced more than 100 first-time vendors to the department, and its process opens with a short solution brief instead of a full proposal. SBIR awards are the other funded entry point and carry no prior-contract requirement.
Should I chase prime contracts or subcontracts first?
Subcontract when the work is large-systems integration, because those programs run through primes with qualified infrastructure you cannot replicate quickly. Prime when the buy is small, service-shaped, or set aside for small business. Most new defense vendors run both, using sub work to earn the record that makes prime bids credible.