Defense AI is Atomus’s newest product. It lets defense contractors use frontier AI models, such as OpenAI’s GPT models, for work that involves CUI and ITAR data. The models run in a government cloud environment your company owns, so prompts never touch commercial ChatGPT or Claude servers. Your team works in tools it already knows, like Claude Desktop.

AI is changing how every company works. Engineers use it to write code, program managers use it to triage their inbox, and business development teams use it to draft proposals. In our calls with defense contractors, we hear the same frustration again and again: everyone else gets to use these tools, and they can’t.

Our mission at Atomus is cybersecurity for the world’s most critical organizations. AI is taking over, and our adversaries are free to use it, but many companies in the US Defense Industrial Base can’t. Defense AI is how we’re closing that gap. Our goal is to bring frontier intelligence to US defense applications and price it as low as we can, so small businesses can succeed. AI will be how small businesses compete.

Why Can’t Defense Contractors Just Use ChatGPT?

Because commercial AI services send every prompt to the vendor’s servers, and CUI and ITAR data aren’t allowed to go there. Under DFARS 252.204-7012, any cloud service that stores, processes or transmits CUI has to meet FedRAMP Moderate or equivalent requirements. Consumer and business versions of ChatGPT, Claude and Gemini don’t.

ITAR raises the stakes further. Pasting controlled technical data into a tool whose servers and staff you can’t account for creates export-control risk, not just a compliance gap.

The compliant versions of these models do exist, but they’re hard to reach:

1. Government-only platforms. The DoD’s own AI portal serves government users, not the companies that supply them.
2. Government editions built for agencies, not small businesses. OpenAI designed ChatGPT Gov for government agencies to deploy in their own Azure tenants. Claude for Government is open to contractors, but it’s bought through Anthropic’s public-sector sales team, and Anthropic sends ITAR data to a different route, AWS GovCloud. Both are set up for large public-sector buyers, not small businesses in the defense industrial base.
3. Do-it-yourself. Standing up models, a gateway, keys and budgets in a government cloud is real engineering work most small contractors don’t have time for.

So most small and mid-sized defense suppliers end up with one of two outcomes. Either nobody uses AI, or people use it quietly and hope nothing sensitive goes in.

Defense AI closes that gap: the same frontier models, deployed into a cloud you already own and already have in your CMMC scope.

How Does Defense AI Work?

Atomus sets up AI models inside a government cloud environment your company owns. Your team uses AI the way they would anywhere else, but every request goes to your account instead of to OpenAI or Anthropic.

What you get

• The AI runs in your own cloud account. We set everything up in a government cloud environment your company owns. Your data stays there: Atomus can’t see it, and the AI doesn’t learn from it.
• Your team uses apps they already know. Each person signs in with their Microsoft work account and connects Claude Desktop and other AI tools in about 15 minutes. Developers can connect their coding tools the same way. Once it’s set up, it works like the AI they’re used to.
• You control who uses what, and what it costs. Admins choose which AI models are available and set spending limits for the company, for teams or for individuals. They get alerts when spending climbs, and an Auto setting picks the cheapest model that can do the job.
• Email and calendar, if you want them. With an admin’s approval, each person can let the AI read their own email, calendar and files.

Does Using AI Change My CMMC Scope?

Not if it runs in an environment that’s already part of your CMMC program. Atomus is one of the biggest partners to the US Defense Industrial Base, managing the cybersecurity programs of almost 200 companies, including the compliance and security of the environments where they handle CUI. Defense AI runs inside that same environment, so it doesn’t add a new outside service to your assessment. Pasting CUI into a commercial chatbot does the opposite: it pulls an outside service into scope.

Like any new tool, it still has to be secured and documented. For existing Atomus Aegis customers, Atomus implements the security controls and documents them as part of the service. If you don’t use Atomus Aegis, you’ll integrate and document Defense AI the same way you would any new cloud tool.

Legal Doesn’t Mean Safe

Defense AI makes AI use legal for CUI. It doesn’t decide what’s wise to put into it. Many former pilots know the saying: legal doesn’t mean safe. Given how important this technology is for the US Defense Industrial Base, we’re rolling Defense AI out according to the guidelines and requirements the US Department of War has set. Each company should still use its own judgment about what’s best for its business and mission.

We’re upfront about the trade-offs:

1. The AI companies’ safety restrictions still apply. The leading model companies usually ban defense use cases in their usage policies, and those rules follow the models into your government cloud. They also keep some records to watch for misuse. We plan to add models your company fully controls for teams that want to avoid both.
2. Not all data belongs in AI. Every company has its own risk tolerance, and some data may not be appropriate for any AI tool. Defense AI doesn’t decide that for you or check what people type. Your policies and training set the line, and the “Defense AI” label in Claude shows employees when they’re on the approved environment.
3. It isn’t for classified data. Defense AI is built for CUI and ITAR, not classified information.

What Does Defense AI Cost?

Two parts: a flat Atomus fee, and model usage billed by your cloud provider.

The Atomus fee: $5,000 a year for companies under 200 employees. It covers deploying and updating the gateway, adding new models as the clouds authorize them, and budgets and usage controls.

For Atomus Aegis customers: Defense AI is added to your CMMC scope, so you don’t need to worry about additional security or compliance overhead.

Model usage: billed directly by your cloud provider at list price. Atomus adds no markup and never sees that bill.

Usage varies more than most people expect, from person to person and company to company. We recommend starting with a small pilot group to see what usage looks like at your company before rolling it out more widely.

How to Get Started

1. Book a demo. We walk through how it works, which models are available and whether your government cloud is ready.
2. Pick a pilot group. Two to four users with a modest monthly budget is the right start.
3. Set up together. On one call we deploy the gateway and models in your subscription, set budgets and connect the first users.

Frequently Asked Questions

Can defense contractors use ChatGPT with CUI?

Not the commercial version. DFARS 252.204-7012 requires any cloud service handling CUI to meet FedRAMP Moderate or equivalent, and commercial ChatGPT doesn’t. Defense contractors can use OpenAI’s models with CUI when those models run in an authorized government cloud, which is what Defense AI sets up in a government cloud environment your company owns.

Is there an ITAR-compliant version of ChatGPT or Claude?

No AI product makes you ITAR compliant on its own; compliance depends on where data goes and who can reach it. Defense AI keeps prompts in a US government cloud environment your company owns, instead of a commercial AI service. Your export-control policies still decide what technical data belongs in any tool.

Can I keep using Claude Desktop?

Yes. With Defense AI, Claude Desktop is the interface and the models run in your tenant. A “Defense AI” label at the bottom of the window shows employees they’re on the approved environment.

How is this different from Microsoft 365 Copilot in GCC High?

Copilot works inside Microsoft’s apps on a per-user license. Defense AI gives your team general-purpose models in Claude Desktop and coding tools, billed by usage, with admins choosing which models are on. Some companies will want both.

Does Atomus see our prompts or data?

No. Prompts and request logs stay in your own government cloud environment. Atomus sees that the gateway and models are deployed, not what anyone asks.

How Atomus Can Help

Atomus is the cybersecurity partner for the US Defense Industrial Base, and more than 150 companies use Atomus to comply with CMMC Level 2 and NIST 800-171. Defense AI extends that work to AI: we deploy the models in a government cloud environment your company owns, set up budgets and access, document the new scope for your CMMC program, and keep adding models as the clouds authorize them.

If your team wants to use AI for CUI and ITAR work without guessing whether it’s allowed, book a demo.