PreVeil bets CMMC's mandate makes encrypted email a defense must-buy

PreVeil is an end-to-end encrypted email and file-sharing platform for organizations that handle sensitive data, installed as an overlay on Microsoft 365 or Google Workspace and marketed mainly to defense contractors that must meet CMMC, NIST 800-171 and ITAR rules.

That CMMC would force tens of thousands of contractors to protect CUI, and a cheap zero-knowledge overlay — not GCC High — would be how small shops pass audits.

About $27M total raised, including a $20M Series C led by PSG (October 2022).

PreVeil was founded in Boston in 2015 by former Apple and Airvana executives Randy Battat and Sanjeev Verma, building on MIT encryption research by CTO Raluca Ada Popa. The original pitch was end-to-end encryption that ordinary users can operate: data is encrypted on the device, no server, admin or even PreVeil can read it, and there is no single point of attack.

The defense pivot came when NIST 800-171 and ITAR made CUI protection a contractual condition: PreVeil became the compliance path for small contractors that could not afford Microsoft's GCC High government cloud. PSG led a $20M Series C in October 2022 to expand beyond defense. DoD's CMMC 2.0 final rule (October 2024) and Phase 1 enforcement (November 2025) turned compliance into a purchase trigger, and by February 2026 PreVeil counted 2,500+ defense-contractor customers with 60+ perfect-110 CMMC certifications.

Still running. On July 13, 2026 the Pentagon suspended CMMC Phase 2 — the third-party Level 2 certification due November 10, 2026 — citing prohibitive compliance costs, a severe assessor shortage, and harm to small suppliers, and opened a 60-day CMMC Reform Task Force review, leaving the regulatory tailwind the company bet on under reform.

The bet was timed to regulation, not fashion: CMMC turned an optional security product into a condition of winning government contracts.

The architecture attacked the cost objection: a quoted ~$200,000 GCC High migration versus ~$20,000 for PreVeil made the pitch obvious for small contractors.

Concrete audit results — 60+ customers with perfect 110/110 scores — gave the company proof that its compliance bundle worked.

The July 2026 suspension shows the risk of building on a mandate: one memorandum paused the exact deadline the company marketed against.

A startup can ride a regulatory mandate to a customer base, but the same regulator can pause it: sell to the underlying obligation, not to the specific certification deadline.

As of September 2, 2026, PreVeil is still running with roughly 2,500+ defense-contractor customers. The CMMC Reform Task Force's 60-day review was expected to report around mid-September 2026; DoD kept NIST SP 800-171 self-assessment obligations in place but removed C3PAO Level 2 and Level 3 certification requirements from solicitations during the pause. PreVeil's guidance to customers is that DFARS 252.204-7012 obligations endure while the certification program is reassessed, and the company continues marketing to professional services, financial services and healthcare alongside defense.