Both fights are real here and they sit inside the same category — but they are not equally winnable. If you carry Netskope, the record supports a partner displacement: the same Netskope SSE part number (NK-P-SSEPA-PRF) has been renewed through three different resellers in three consecutive years, so CDCR is loyal to the OEM and indifferent to who invoices it. If you carry a Zscaler competitor, the record supports an OEM fight — but Solutions Simplified has already cut annual purchase orders dated out to 2029-10-31, so that is not a renewal contest, it is a consolidation argument that has to be won on architecture, not price.
Three renewals, three resellers, one unchanged part number. The customer has already demonstrated it will move this line. The 2025 renewal was $1,916,720, executed 2025-07-01 — a July date, which is the money window: about 14% of the state's POs but roughly a third of the dollars, at roughly five times the average deal size. July paper is decided in the prior budget cycle, so the influence window for the next one runs from the preceding summer through January. Presidio Networked's most recent activity in scope is 2026-05-14, which coincides with buyer Kamran Khalid's most recent PO date — check whether that is the next Netskope cycle before assuming it is open.
The record shows Zscaler platform paper cut annually through 2029-10-31 and Netskope SSE renewed every year alongside it. Somebody inside CDCR owns the eventual decision to collapse that to one. You do not win this by bidding against a purchase order that already exists; you win it by being the party that framed the overlap, the licence duplication and the AnyConnect end-state ($748,284 twice in 2022, then silence). This is slow, it makes you the advisor rather than a supplier, and it is the only route into Solutions Simplified's $11,047,063.
Envision 2026 lists SOC-as-a-Service & monitoring as due each quarter through 2026 with 0.9% penetration against $497,489,919 of related budget. The department already owns the two components a managed detection story attaches to: ServiceNow Security Operations at $4,649,007 and a Splunk services line ending 2028-06-29. That is their stated priority plus their existing tooling — a much better opening line than any product pitch, and it does not trespass on the three themes where they are already established.
The McAfee ATD 3100 at $1,184,010 from 2020-08-12 has no successor on file. Absence of a purchase is not absence of a product — it may have been renewed on a statewide vehicle that never lands in this record, or replaced by capability inside the Zscaler or Netskope stack. Phrase it as a question about what took over sandboxing, not as a claim that nothing did.
Situation
Security & Identity at CDCR is 308 POs and $47,678,806 across 92 suppliers, running 2016-05-18 to 2028-11-01 — 2.0% of the department's $2,432,892,821 total. The interesting fact is not the total. It is that the department appears to be buying two competing secure-service-edge platforms at once, from two separate reseller camps, on two different renewal calendars.
Camp one — Zscaler, held by Solutions Simplified. Solutions Simplified is the largest supplier in scope at 19 POs and $11,047,063 (23.2%), last dated 2028-11-01. Four identical purchase orders of $1,247,502 each carry Zscaler Essential Platform (ZS-ESS-Platform), dated 2025-10-27, 2026-11-01, 2027-11-01 and 2028-11-01, the last with a term ending 2029-10-31. Behind those sit older Zscaler Internet Access lines through the same reseller — $903,456 on 2022-02-25 and $843,456 on 2022-07-01 — both now aging with no renewal date on file. The same reseller also holds a small Splunk services line of $100,000 ending 2028-06-29.
Camp two — Netskope, and it moves. The identical Netskope SSE Professional package has been bought three years running by three different resellers: DHENALI INC at $1,420,750 on 2023-02-27, PRESIDIO NETWORKED SOL GROUP at $1,517,639 on 2024-07-29, and PRESIDIO HOLDINGS INC at $1,916,720 on 2025-07-01. An earlier Netskope secure web gateway line sits with Presidio Networked at $756,600 on 2022-04-20 (20,000 seats at $22.02). Presidio Networked Sol Group totals 13 POs and $6,680,654, last dated 2026-05-14.
That is the finding. The Netskope reseller changes almost every cycle; the Zscaler reseller has not changed at all. That asymmetry decides which fight you pick.
Three other things in scope matter to the argument. Presidio Networked also carried Cisco AnyConnect at $748,284 in each of 2022-01-14 and 2022-07-01, both now aging with no renewal date — the classic remote-access line that SSE/ZTNA eventually absorbs, and its silence is worth a question rather than a conclusion. A McAfee Advanced Threat Defense appliance bought through Carahsoft for $1,184,010 on 2020-08-12 is well past refresh with nothing recorded after it. And the single largest PO in scope is $4,649,007 for ServiceNow Security Operations Enterprise, bought on 2025-06-16 from VETERAN ENHANCED TECH SOLNS — one supplier, one purchase order, dated squarely in the June spend-down surge.
On statewide priorities, be disciplined. California's own Envision 2026 scoring marks CDCR as established on Zero Trust Architecture ($17,730,953, 11.1% penetration), Identity & Digital ID ($39,044,746, 6.1%) and Cyber resilience & recovery ($27,157,619, 33.7%). Do not walk in with a zero-trust gap story — they have demonstrably spent. The open theme adjacent to this scope is SOC-as-a-Service & monitoring, scored 31, due each quarter through 2026, with $4,691,983 spent against $497,489,919 of related budget — 0.9% penetration, early/pilot.
What they are about to build
One project is in implementation: BIS Migration to S4 HANA (BIS-2-S4), $68,289,406, oversight rating Green (5225-180). Green means oversight is not flagging it — there is no distress to exploit, and pitching remediation into a Green project reads as noise.
The relevant join is elsewhere. CDCR's own job posting states it "manages, directs, and has an overall responsibility for the on-going operations of the SAP Enterprise Resource Planning (ERP) solution" (https://calcareers.ca.gov/CalHrPublic/FileDownload.aspx?aid=14564782&name=065-623-1405-001DS.pdf) — an independent source corroborating that SAP is run in-house, not merely bought. Separately, the cross-source data flags Oracle as CORROBORATED: named in a current BCP and 57 POs / $38,622,397 already on file, last 2026-07-29, led by TABORDA SOLUTIONS INC at $15,084,302 — and Taborda also appears in this security scope at 4 POs / $1,800,584. An identity and access-governance requirement attached to an S/4HANA cutover is a plausible security-scope consequence of that project, but it is an inference from a job posting plus a pipeline entry, not a recorded purchase. Ask it; do not assert it.
Two budget requests sit inside or beside this scope and are requests, not awards: 2026-27 Governor's Budget BCP for a Board of Parole Hearings Information Technology System Contract, and 2025-26 Governor's Budget BCP for Public Safety Radio Replacement. The radio request has a purchase-record echo — $1,785,900 of Motorola APX NEXT portables bought direct from MOTOROLA SOLUTIONS INC on 2025-09-23, part of $1,848,016 across 3 POs. That is a REQUESTED-ONLY link on the money side, and a direct-from-manufacturer route on the buying side.
Questions to ask
1. Zscaler and Netskope both appear as current SSE platforms in the purchase record — which one is the strategic standard, and what is the other one doing?
2. Who owns the Netskope renewal requirement, and is the reseller selected fresh each cycle or carried forward from the prior year?
3. The Netskope paper has moved through three resellers in three years — what drove each change: pricing, vehicle, or service?
4. Cisco AnyConnect was renewed twice in 2022 and does not reappear. Was remote access folded into the SSE platform, or is it now bought on a statewide vehicle outside this record?
5. What replaced the McAfee Advanced Threat Defense appliance bought in 2020, and where does sandboxing and detonation live today?
6. ServiceNow Security Operations was bought in a single $4,649,007 PO in June 2025 — is that a multi-year entitlement, and who is operating the SecOps workflows now?
7. Envision 2026 lists SOC-as-a-Service and monitoring as a quarterly 2026 commitment — is CDCR's SOC in-house, contracted, or hybrid, and what is the 2026 milestone?
8. Does the S/4HANA migration carry an identity, privileged-access or access-governance workstream, and does that sit with the CISO or with the BIS project?
Who to talk to
Leadership — sets direction. Ken Kojima, Chief Information Security Officer, is the only name on file who can arbitrate a two-platform SSE overlap; no email is on record, so route through the buyers or the department directory. Austin Uwakwe (Associate Director) and Norman Lim (Branch Chief) are the operational layer that would own a requirement definition. Georgia Johas-Darnell and Karen Reed, both Chief Deputy Administrator, matter for executive sponsorship on anything that reaches a BCP. One contact on the list, "Deloris E-Mail, Chief, Case Records," carries a corrections.govt.nz address — treat that record as bad data, not a New Zealand connection.
Buyers of record — they sign. Robin Adams: 10 POs, $6,554,382, most recent 2028-11-01 — that date matches the forward-dated Zscaler PO exactly, so Adams is the likely owner of the Zscaler paper (inference from date alignment; confirm it). Robin Ramirez: 22 POs, $3,806,867, most recent 2025-10-27 — the same date as the 2025 Zscaler line. Kamran Khalid: 10 POs, $8,305,876, most recent 2026-05-14 — the same date as Presidio Networked's last activity in scope, which makes Khalid the first call on the Netskope side. Jessica Tong (29 POs, $7,911,825) and Pa Vue (19 POs, $4,758,929) have the volume history but older recent dates. Naseem Fallahi has the highest PO count at 52 for $4,419,679, most recent 2026-07-01 — high-frequency, lower-value work, useful for understanding process.
Route to market
Solutions Simplified, Presidio Networked Sol Group, Presidio Holdings, NWN Solutions ($2,345,302), Carahsoft ($1,919,390), Taborda ($1,800,584) and Dhenali all transact here today, so the vehicles exist and the department is not single-sourced by habit. Motorola sells direct, which means the radio lane behaves differently from the software lanes.
Two vehicle facts to verify before quoting. First, DGS bulletin K-40-24 (2024-10-15) awarded the current-generation Enterprise Technology statewide contract family, replacing 1-19-70-19(A-S) — that is the turnover point, and the roster comparison tells you which resellers kept which OEM relationships across it. Confirm your own authorisation on the current roster for every line you intend to quote, because a lapsed authorisation is fatal and invisible until award. Second, K-63-25 (2025-12-26) named the resellers carrying ServiceNow GenAI promotional pricing — AHEAD/Kovarus, HF Tech Services, Apex Systems dba GlideFast, Integrhythm and Ignyte Group — and Veteran Enhanced Tech Solns, which took the $4,649,007 ServiceNow PO, is not among them. Worth understanding which route that PO actually used before assuming ServiceNow is closed ground.
Two DGS certification removals are on the record in early 2026 — Mergent Systems (K-14-26) and Eyep Solutions (K-04-26), both Small Business certification removed from the Enterprise Technology contract. Neither is a supplier in this scope, but the mechanism matters: SB and DVBE preference points decide close silos outright, so a partner's certification status is a bid-strength fact, not a formality. Note also that Cradlepoint was renamed Ericsson Enterprise Wireless Solutions on 2026-02-13 (K-11-26) — one company, two names in purchase records either side of that date.
Timing across the whole department: $398,241,425 across 136 dated terms end within 18 months while four BCPs and one pipeline project are live. Replacement conversations are happening now, not next year.
The first 90 days
| What | Who | By when |
|---|---|---|
| Confirm your own current authorisation for every line you intend to quote against the post-K-40-24 Enterprise Technology roster | Your contracts lead | Day 10 |
| Establish whether the 2026-05-14 Presidio Networked PO is the next Netskope cycle or unrelated | Kamran Khalid | Day 20 |
| Map the SSE estate: which platform is standard, which is legacy, what happened to AnyConnect | Ken Kojima / Austin Uwakwe | Day 25 |
| Confirm who owns the Zscaler annual line signed out to 2029-10-31 | Robin Adams, Robin Ramirez | Day 25 |
| Diarise: Cellebrite training term ends 2026-10-31 ($15,850, Tech Masters) — small, but a live dated renewal to be present for | Norman Lim | Day 30 |
Success by day 30: you can state, from the customer's own mouth, which SSE platform is the standard and who arbitrates the overlap.
| What | Who | By when |
|---|---|---|
| Draft a one-page SSE overlap and licence-duplication assessment, framed as their consolidation question, not your proposal | Kojima, Uwakwe | Day 40 |
| Scope a named SOC/monitoring initiative against the Envision 2026 quarterly-2026 commitment, built on the existing ServiceNow SecOps and Splunk lines | Kojima, Lim | Day 50 |
| Scope a threat-defence refresh option tied to the 2020 McAfee ATD line, contingent on the answer to what replaced it | Ramirez, Fallahi | Day 55 |
| Establish whether the S/4HANA programme carries an access-governance workstream, and who owns it | BIS-2-S4 programme, via Uwakwe | Day 60 |
Success by day 60: two initiatives exist in writing with a named CDCR owner each, and at least one is described back to you in their words.
| What | Who | By when |
|---|---|---|
| For the Netskope renewal: fix requirement owner, technical champion, executive sponsor, buyer of record, vehicle, OEM authorisation letter, budget source, likely PO date, incumbent (Presidio Holdings, $1,916,720, 2025-07-01) | Khalid + Kojima | Day 75 |
| For the SOC initiative: same nine fields, plus whether it lands as a PO, an amendment to the Splunk services line ending 2028-06-29, or a future BCP | Lim + Johas-Darnell or Reed | Day 85 |
| Position for the July money window — a renewal executing in July is decided in the prior cycle, so secure the January-cycle conversation now | Executive sponsor | Day 90 |
| Confirm GenAI Disclosure / STD 1000 (K-27-24) compliance for anything GenAI-adjacent before it can be awarded on an LPA | Your contracts lead | Day 90 |
Success by day 90: one opportunity has all nine fields filled in and a named procurement date, and you have written OEM authorisation in hand for the line it depends on.
What this rests on
- This is a purchase record, not an install base. It shows what was bought and by whom, not what is running today. The Zscaler POs dated 2026-11-01 through 2028-11-01 are commitments on paper; they are not proof the platform survives that long, and they are not proof Netskope is being retired.
- Attribution of platforms to resellers comes from PO description text. Solutions Simplified, Presidio and Dhenali are the firms that won the paper; the manufacturer relationships behind those wins are inferred from part numbers, not stated in the record.
- Absence is not evidence. Cisco AnyConnect, the McAfee ATD refresh and any identity platform successor to the 2020 Okta line ($970,080, Kovarus, 2020-06-30) may all sit on statewide vehicles that never appear in this dataset. Every one of those is written above as a question.
- The buyer-to-platform attributions — Adams to Zscaler, Khalid to Netskope — are inferred from matching PO dates only. They are the best available signal and they must be confirmed in the first conversation, not asserted in a meeting.
- Envision 2026 theme totals are keyword-matched. They establish presence and absence, not exact spend; CDCR may run a SOC programme under a name these records do not use.
- The BCPs named here are requests to the Legislature, not awards. Some are denied, some cut, some funded at a fraction. Their value is sequence and timing, not budget.