SAIC acquires ISC to bolster zero-trust and post-quantum cryptography
Science Applications International Corp. has completed its acquisition of Information Security Corporation, a specialist in public key infrastructure, encryption, and credential management software with more than 30 years of deployment across the US intelligence community and federal defence agencies. Financial terms were not disclosed.
The deal is described by SAIC as a tuck-in acquisition, meaning ISC is expected to be absorbed into the existing business rather than operate as a standalone unit. SAIC, which is headquartered in Reston, Virginia and reports annual revenues of approximately $7.3 billion, was advised by KPMG on the transaction; ISC was represented by TideLock Partners.
What ISC brings to the table
ISC's product suite centres on PKI, data protection, and credential lifecycle management. Its flagship product, CertAgent, has featured on the National Security Agency's Commercial Solutions for Classified Components List for more than a decade, a certification that signals deep integration into classified government workflows.
The company's technology is positioned by SAIC as "crypto-agile": designed to allow customers to swap or upgrade cryptographic algorithms without overhauling underlying infrastructure. That capability is commercially significant as the US federal government accelerates its migration away from classical encryption standards in response to the coming threat from quantum-capable adversaries.
Jim Reagan, chief executive of SAIC, said integrating ISC's cryptographic technologies with SAIC's existing zero-trust architecture practice would give intelligence and defence customers "the security and scalability to protect against rapidly evolving threats."
Market context and regulatory backdrop
The acquisition is timed against a gathering compliance deadline. The US National Institute of Standards and Technology finalised its first set of post-quantum cryptography standards in 2024, and federal agencies are expected to begin mandatory migration by 2030. The National Security Memorandum on quantum computing, issued in 2022, required agencies to inventory cryptographically sensitive systems; that cataloguing phase is now giving way to active remediation programmes, creating a commercial opportunity for vendors whose tools sit directly in the migration path.
SAIC is not alone in pursuing this market. Leidos, Booz Allen Hamilton, and Peraton compete across similar defence IT and cyber integration contracts, and a number of specialist cryptography vendors, including Thales, Entrust, and DigiCert, offer competing PKI and certificate-management platforms. The addition of an NSA-listed product, with a multi-decade footprint in classified environments, gives SAIC a credentialled asset that would be difficult for a new entrant to replicate quickly.
The zero-trust architecture market, meanwhile, has matured considerably since the Biden administration's 2021 executive order on cybersecurity mandated zero-trust adoption across federal agencies. Most large systems integrators now offer zero-trust programme design and implementation; the differentiation is shifting toward integration depth and the ability to operate in air-gapped or classified environments. ISC's background in high-sensitivity settings aligns with that direction.
What to watch next
SAIC has not disclosed integration timelines, pricing changes to ISC's existing product licences, or the size of the ISC employee base joining the acquirer. Jonathan Schulze-Hewett, ISC's Vice President of Development, indicated the team expects broader distribution under SAIC's umbrella, suggesting the focus in the near term will be cross-selling CertAgent and related tools into SAIC's existing contract base rather than pursuing new commercial markets. Investors will be watching for disclosure of any incremental contract wins attributable to the acquisition in SAIC's next quarterly results.