Summary
- Acuity RM announced additional international defence programme contracts on 12 October.
- Its Stream Classic platform will support a second prime contractor and the central programme organisation.
- The new contracts are expected to generate more than £125,000 in annual recurring revenue.
UK cybersecurity software supplier Acuity RM has secured additional contracts to provide governance, risk, and compliance software for an international defence programme, extending its deployment to a second prime contractor and the organisation coordinating the programme. The company announced the awards on 12 October, following related agreements reported in August and September.
The new contracts cover use of its Stream Classic platform, a system designed to record and manage cybersecurity risks, associated controls, and compliance information. The company says the latest agreements will generate annual recurring revenue of more than £125,000. It has not identified the defence programme or the participating organisations in its announcement.
The addition means two prime contractors and the central programme organisation are now using Acuity’s platform under the broader arrangement. The company’s disclosures also refer to discussions with a possible third prime contractor and additional consultancy work. Such talks are prospective, and neither should be treated as a signed contract or a guaranteed extension of revenue.
The contracts are relatively modest in value, but will extend a common risk-reporting system to the programme’s central organisation and two prime contractors. Defence primes rely on layers of subcontractors and specialist technology providers, each holding different evidence about products, software, access controls, and operational dependencies. A central programme can require comparable reporting without directly operating every system involved.
Common reporting across organisational boundaries
Governance, risk, and compliance platforms typically help organisations record assessments, assign responsibility for controls, collect audit evidence, and report the status of identified issues. Their value depends on the quality and currency of information entered, as well as the authority of programme managers to require remediation when a concern is identified.
Shared tools can make it easier to compare control assessments across participants, but a common platform does not eliminate differences in supplier architecture, national requirements, or the classification of sensitive defence information. The method by which risks are scored, verified, and escalated must be agreed separately from the purchase of software.
Where a prime contractor participates in a multinational programme, the reporting requirement may involve several layers of accountability. One business can be responsible for a particular subsystem, another for integration, and a central programme body for assurance across the whole. Maintaining a common picture of dependencies can help reveal when a technical weakness in one supplier affects other parts of the programme.
Acuity’s announcement does not establish that the participating firms have achieved a particular certification, eliminated an identified weakness, or improved their operational security by a measured amount. Nor does it identify the technical controls that have been implemented as a consequence of adopting Stream Classic. Those outcomes would require separate evidence from customers or independent assessments.
The group said it expects collaboration among defence organisations to support demand for risk management and compliance systems. That is a company outlook, not a market-wide sales forecast. The timing and value of any future business also depend on procurement decisions by parties outside Acuity’s control.
Acuity disclosed the awards as regulated market information on 12 October. The contracts add more than £125,000 in annual recurring revenue, but neither participating organisations nor independently assessed operational results have been disclosed.
