An Inflection Point for U.S. Government

The U.S. Government (USG) has three intertwined challenges:

1. Resilience in a world where technology increases and democratizes the ability to act against American interests
2. Enabling public-good R&D without a budget surplus
3. It’s difficult to actually invest in proactive Resilience or R&D when maintenance of legacy USG IT systems in civilian, public health, and national security missions eat up so much budget

Challenge #1, with AI proliferation, has entered a new phase of risk and complexity. Addressing it requires leveraging multiple strategies, including proving our “ability and willingness” to establish proactive Resilience. Integrating best-in-class AI into every mission-critical workflow is central to this. Operational speed, a key battlefield advantage, will favor those implementing leading AI tools in alignment to their specific use cases.

Data-to-decision, systems integrations, intelligence analysis, cybersecurity, incident response, and much more must leverage AI with the same ubiquity as computers and software itself.

Challenge #2 is an enduring problem. Software was already helping reduce the cost to identify and run experiments of increasing complexity, and AI developer tools, like Windsurf, will help software help R&D.

Challenge #3 is also an enduring problem, and affects our ability to address Challenge #1. In 2011, ~70% of Federal IT dollars went to Operations & Maintenance (O&M), with only ~30% going to Development, Modernization, and Enhancement (DME). Today, the figure is ~80% O&M to 20% DME. We spend far less on transformative innovation, such as AI integration, than we do on maintaining old, legacy systems.

The history and nuances here deserve its own blog post and debate forum. They involve the honest evolution of technology and human capital, misaligned incentives (see here and here) where classifying spend as “O&M” instead of “DME” led to reduced regulatory scrutiny, and the downstream reality that lots of new O&M spend is actually effectively DME. Regardless, bi-partisan calls for action reflect that there is consensus we have a problem - even if the exact magnitude is unknown:

• 2015: M-15-14 Management and Oversight of Federal Information Technology
• 2018: Technology Modernization Fund
• 2024: MITRE report outlining various calls for action
• 2025: EO 14158, Section 4 Modernizing Federal Technology and Software
• 2025: H.R. 2985 Modernizing Government Technology Bill

As detailed in the MITRE report, despite political will, these efforts have fallen short because the up-front cost, complexity, and risk is too high to yield scaled execution. There is also a dearth of engineers with the skillset to understand (and thus modernize) legacy systems. Enter Windsurf.

How Windsurf is Uniquely Equipped to Serve USG and Allies

Capabilities

AI is finally good enough to address Challenge #3 at scale. Windsurf is an AI developer tool that enables programmers and engineers to work faster and better. It is a force multiplier that accelerates every stage of software development. Custom Computer Programming, managing software licenses, data processing, migration, and CI/CD has never been easier.

The cost to modernize and/or migrate IT systems dramatically drops when can engineers can, with Windsurf:

• Understand, explain and onboard to an existing codebase 4-9x faster
• Use AI for developing in often unsupported or legacy languages like COBOL, Assembly, and Fortran. This is in addition to modern languages that Windsurf obviously also supports
• Easily convert code from one programming language to another
• Use Customizations, such as Memories, Rules, and Workflows to seamlessly enforce any of the following:
  • STIG protocols during application migration
  • Syntax and data structures during data integration
  • Business logic preservation during Function and Class refactoring

Gartner did a study in 2024, and ranked Windsurf as the #1 AI-Coding tool to, amongst other things, Modernize Code. To fix O&M spend going to systems that have no added value without migrating their functionality to a new platform, Windsurf is, unequivocally, the best option. Since that study, we launched Cascade:

• Fundamentally, Cascade’s Collaborative Agents (i.e. Flows) bridge the gap between copilots (ex: GitHub Copilot) and AI agents (ex: Devin, Jules) by combining their strengths. It’s far more effective than generic AI workflow tools (ex: AskSage) or chatbots (ex: CamoGPT) that aren’t built for software development.
• Collaborative Agents such as Cascade retain human-in-the-loop capabilities for guidance and error correction. USG use cases have low risk-tolerance. The workflow must ensure potential errors by AI can be surfaced to and addressed by humans every step of the way.
• Cascade, when combined with our new Windsurf Editor IDE, enables us to better understand what works and doesn’t under the hood. We’re able to improve our AI with greater confidence than when we relied exclusively on IDE plugins (which continue to be a long-term investment)

Addressing Challenge #3 will enable USG to invest in Challenge #1 and #2, where Windsurf already has deep experience:

Current Traction

Windsurf is used today by recognizable organizations developing mission critical systems, pursuing research, and handing large codebases:

Federal Traction:

• 2 Federal Agencies - direct developer use
• 2 out of top 7 Defense Primes
• Anduril (case study here)

Highly Regulated Industries:

• J.P. Morgan Chase (recognition here)
• Dell
• Athena Health
• Cisco
• 1000+ more enterprises

Security & Compliance

USG faces strict compliance and security requirements when selecting AI developer tools.

First, Windsurf took a proactive approach to GenAI security, independent of industry regulations. Our Hybrid Deployment model both separates the data layer and enables customers to receive logs for Attribution Logging, Chat, Autocomplete in order to form a thesis on how AI influenced their code base. Those Logs can power SIEM/SOAR workflows per SOC teams’ discretion.

Second, Windsurf is the first, and currently only, AI developer tool to achieve FedRAMP High authorization, DoD IL5 compliance, and the ability to handle International Traffic in Arms Regulations (ITAR) controlled data, enabling it to securely manage Controlled Unclassified Information (CUI). No other AI developer tools have attained such rigorous compliance standards to date. Note:

• Since audit logs are required by law to be retained for 18 months, our FedRAMP High/IL5 offering does not provide the same logging as Hybrid Deployment

• The FedRAMP High/IL5 offering generates audit logs per NIST AU-2 and AU-3 standards that can be sent to any DoD specified CSSP to support SIEM/SOC workflows at their discretion.

Competitive Analysis

Comparison against Cursor, Copilot, AskSage, CamoGPT, and Cline.

To preface, we respect all technologies currently serving the USG. However, conducting a no-cost or low-cost competitive evaluation of AI-coding capabilities against any of the FedRAMP accredited vendors listed below will demonstrate Windsurf’s significant capability advantage. AskSage and CamoGPT have all the compliance requirements. But they are not peer AI-developer tools.

Capability

• GitHub Copilot: Per Gartner’s 2024 Critical Capabilities Ratings, Windsurf beats Copilot in 11 out of 14 categories
  • We are tied on Supported Languages and Frameworks, but suspect that without properly using Windsurf’s Customization features, the Frameworks element was not evaluated with enough rigor
  • Copilot is ahead on Analytics Dashboard and UX, but study was done without including Windsurf’s Cascade, which launched in November
• AskSage: This is not a professional AI Coding Assistant. The code generation quality, pricing, UX, and (lack of) codebase awareness reflects that. AskSage is an AI workflow tool
• CamoGPT: It is a chat tool, not an integrated development environment (IDE)
• Cursor: Lacks appropriate security
• Cline: Cline’s open-source model is great for individual developers, but risky for federal and enterprise use cases from both a security and quality assurance standpoint

FedRAMP High and DoD IL5

• GitHub Copilot: Lacks any FedRAMP accreditation. GitHub SCM holds only FedRAMP Tailored authorization, designed for low-risk SaaS applications
  • But Copilot is not part of this and not listed in the FedRAMP marketplace
  • Recent news implies they are still pursuing FedRAMP Moderate, but it remains to be seen if Copilot is part of this
• AskSage: Holds FedRAMP High and IL5 and is capable of on-prem deployment
• CamoGPT: Deployed on DoD networks through IL5/IL6 and operates under agency-specific authorizations
• Cursor: Lacks any FedRAMP accreditation
• Cline: OS packages are installed on endpoints, and require users to fully manage their own security compliance, including at the model level

ITAR Compliance

• GitHub Copilot: Not available in an ITAR compliant manner. Github directs ITAR workloads to its on-premises Enterprise Server, but Copilot is not included in this package.
• AskSage and CamoGPT: Don’t emphasize coding-specific ITAR controls (aka, we don’t know)
• Cursor: Users have publicly requested ITAR solutions since March 2025, with no resolution
• Cline: Requires users to fully manage their own ITAR compliance, including at the model level

Competitive Analysis of AI Developer Tools

GitHub Copilot: A Defender-esque Microsoft Story

GitHub Copilot’s FedRAMP Tailored status limits its use to low-risk workflow. Owned by Microsoft, Copilot has striking analogues to Microsoft Defender EDR: Relevant due to distribution power, but never best-of-breed and eternally reactive in security.

Boilerplate security SOC 2 Type 2 compliance to 3rd party testing, Copilot has done after competitive pressure. We’ve documented our testing with their security or attribution filters as well.

Today, Copilot’s own Trust Center FAQ states that:

If you are using Copilot outside the code editor, your prompt, suggestion, and supporting context will be stored for 28 days.

This is a very plausible workflow for Federal customers using CLI or other entry points. Windsurf does not do this for Enterprise (Cloud and Hybrid) or FedRAMP customers.

Windsurf’s Strategic Edge

Competitors either lack critical certifications (Cursor), prioritize non-coding use cases (AskSage, CamoGPT), or are a mix of both shortcomings (Copilot, Cline). For federal agencies, Windsurf’s unique alignment of FedRAMP High, IL5, and ITAR compliance with advanced coding AI makes it the optimal choice. As defense agencies modernize software development, Windsurf delivers both security and innovation - a dual mandate others fail to meet.

Partnerships with Palantir FedStart, Carahsoft, and AWS GovCloud streamline federal procurement. We’re on the following Contracting Vehicles and ready help USG address every challenge:

• NASA SEWP V | NNG15SC03B/NNG15SC27B | May 01, 2015 - Oct 31, 2025
• ITES-SW2 | W52P1J-20-D-0042 | Aug 31, 2020- Aug 30, 2025 | *Additional Option Years Available