Why the CMMC Pause Is Good News for AI Adoption

September 2, 2026

Teddy Wexler

In July the Department of War suspended the CMMC Phase II rollout and kicked off a 60 day review. A lot of suppliers read that as permission to stop spending on compliance. We think that reading is wrong, and we also think the pause creates a real window.

Your NIST 800-171 obligations did not move. DFARS 7012 is still in your contracts. What moved is the assessment deadline, which means the clock pressure is off for the first time in two years. If you have been putting off modernizing how your engineers use AI because you were heads down on assessment prep, this is the moment to fix it.

The suppliers we talk to all have the same story. Engineers are already using AI, mostly through personal accounts, and nobody can say what left the building. Getting that traffic onto one governed endpoint takes an afternoon with Demilune. When assessments resume, the audit trail is already there.

If you want to see what that looks like for your shop, request access on our home page and we will get you onboarded.

Why We Started Demilune

August 30, 2026

Teddy Wexler and Arjun Chandra

We met in a national security summer fellowship in DC. The reading one week was about the defense industrial base, and one number stuck with both of us: roughly 300,000 companies supply the primes, and most of them have less IT staff than a mid sized dentist office.

Defense tech is having its moment. The primes and the venture backed hardware companies are hiring AI teams and standing up their own model infrastructure. The machine shop in Ohio that mills the bracket is not. Their engineers use the same consumer chatbots everyone else does, except their CAD files and process sheets are export controlled.

We interned at places that take this stuff seriously and we kept asking why nothing existed at the supplier price point. The honest answer is that it is not a fun product to build. It is proxies and audit logs and compliance mappings. We decided that was exactly why we should build it.

Demilune is an AI gateway built for the 300,000. One endpoint your whole shop points at, every approved model behind it, and a paper trail your assessor will accept. We are onboarding a few suppliers each week while we work toward our SOC 2. If that sounds like your company, we would love to talk.