Digital Golden Dome – Could It Be Next for the Defense Department?

BLUF;

A new report calls for a “Digital Golden Dome” to protect DoD systems from software vulnerabilities and AI-powered cyberattacks. Software memory protection could help prevent exploits without costly code rewrites or lengthy recertification, but department-wide adoption will require dedicated funding and leadership support.

The Defense Department’s Golden Dome for America program is building a next-generation missile defense shield to protect the United States from a variety of aerial threats. The Pentagon needs a similar architecture to secure its software, a new report argues.

Why Memory-Unsafe Software Puts Defense Systems at Risk

Many Pentagon weapon systems utilize coding languages such as C and C++ that are considered “memory-unsafe,” according to “The Call for a Digital Golden Dome,” published by Lionfish Tech Advisors in September.

These languages let developers manage memory directly, with no automatic checks on how that memory is used. Small mistakes can open holes an attacker can use to take control of a system, said Brad LaPorte, an advisor at Lionfish and co-author of the report.

With the rise of artificial intelligence, threat actors can pinpoint and exploit a vulnerability in seconds. For government systems, any rewrite or patch of the software is expensive and time-consuming, as the new code must go through a lengthy certification process, said Lionfish founder and CEO Rob Smith.

The Pentagon Programs Using Vulnerable Software

There are more than 140 Defense Department programs across 19 Pentagon components utilizing memory-unsafe software, the report stated. They include capability areas such as: aviation; ships and naval combat systems; missiles, munitions and air defense; space; ground combat and unmanned systems; and command and control, networks, sensors and cyber, according to LaPorte.

These programs could benefit from a concept the report called the “digital Golden Dome.” In other words, a software memory protection capability that stops an attack from working in the first place, LaPorte said.

Most memory exploits depend on knowing exactly where code and data sit in memory. Software memory protection capabilities rearrange that layout, so when an attacker triggers a flaw, the exploit fails instead of taking control, and the system keeps running normally. While the underlying bug is still there, the attacker cannot use it.

Smith compared it to a security guard watching the front window of a store. “If it’s smashed, he calls for help. If it’s not smashed, he just sits there for 24 hours … and watches to make sure it’s not broken.”

“It’s a hardening element,” LaPorte added. “The attack still happens, [but] it bounces off effectively, or it doesn’t penetrate. The blast radius is significantly less.”

Hardening Software Without Disrupting Mission Operations

This capability exists today and can be implemented without changing the software’s source code or behavior, meaning it can be deployed without forcing a recertification of the mission function, the report stated.

“Inside of a year, we could solve this problem, and it wouldn’t be a major overhaul either,” LaPorte said. “Part of it is reallocating the resources that are already underway to do this manually.” A full rewrite of the entire U.S. codebase using a memory-safe language would cost nearly $7 trillion, he estimated.

The National Security Agency and Cybersecurity and Infrastructure Security Agency in June 2025 issued guidance directing that the C and C++ that cannot be easily replaced with memory-safe languages be hardened, the report noted.

“What is missing is neither the technology nor the policy signal,” it said. “What is missing is funding and a mandate at the department and service level, rather than one program at a time.”

How AI Is Accelerating Software Exploits

LaPorte said one reason software memory protection has not been implemented across the Defense Department is “shiny object syndrome.”

“I think we have a lot of priorities going in a lot of different directions,” he said. The change in administration last year has played its part; for example, Golden Dome wasn’t a top-tier priority until fairly recently.

However, “we have to acknowledge that not everything is a kinetic effect. It’s digital as well,” he said. Those lines have begun to blur, as shown by the conflicts in Iran and Ukraine.

“A lot of nation states have very robust digital capabilities now … very devastating capabilities that we don’t necessarily have the protections for,” he added.

Other challenges include the significant knowledge gap within the U.S. and allied governments on the available security solutions, and the rapid rise of AI as an exploit tool, LaPorte and Smith said.

“Everyone thought that [it] was going to take three, five, 10 years to get to where we are today” with AI, LaPorte said. “That’s now [on] a J curve, going straight to the moon.”

AI-enabled attacks that are occurring today didn’t exist a year ago, he added. “It’s now increasing exponentially, and so we went from months to weeks to days to now hours to minutes in terms of just the overall velocity of what AI can do, … and we haven’t pivoted yet.”

With AI now able to develop new ways to attack software systems within seconds, “you cannot stop the exploits. … Anybody who tells you they can is lying to your face,” Smith said.

“The level of technology doesn’t matter. What matters is that you have this cop watching the window, and … when the window breaks — not if the window breaks — [he] goes, ‘Hey, alarm, alarm, alarm,’” and stops the attack from succeeding, he said.

As the Defense Department builds out the Golden Dome missile defense architecture, it needs to ensure the software inside the interceptors works when it is needed, LaPorte said. “Otherwise, it’s just a bunch of metal.”

Key questions this article answers

As a cybersecurity firm with deep roots in the Department of War (DoW) cybersecurity community, SecureStrux provides specialized services in the areas of compliance, vulnerability management, cybersecurity strategies, and engineering solutions. Contact us today to schedule a meeting.

The original article was written by Josh Luckenbaugh and can be found here.