EDD's routed network core is Cisco — the record's own part numbers (Nexus 9336FX2, Nexus 9300, Catalyst 9300 UPOE) name it, all of it bought through Presidio Networked Sol Group, all of it four to seven years old with no renewal date on file. Your line already sits next to it: Palo Alto, 24 POs, $32,839,251, most recent 2026-05-05 — but the two resellers who wrote most of that history are not on the current DGS statewide award, and the one that is has a $3,585,744 managed-detection contract expiring 2026-06-30. The play is to make NWN the single Palo Alto route into EDD, use the June expiry as the near-term event, and attach the architectural argument to Zero Trust, which EDD itself committed to for Q4 2026 and has barely funded.
$3,585,744, "Palo Alto Network eXtended Managed Detection and Response service," ends 2026-06-30. This is your own OEM under a service wrapper, sold by the partner who tied for top score on the statewide Palo Alto silo. It is the cleanest near-term event in the scope. But note the timing rule: a June-dated end is a fast-close on money that must be spent, while the FY26/27 replacement was shaped in the prior budget cycle — Governor's proposal in January, May Revise, enactment by June 15. If you want to change the shape of that renewal rather than just re-sign it, the influence window is the preceding summer through January. Do not arrive in May.
$1,567,390 of Nexus 9336FX2 support (2020), $1,227,854 of Nexus 9300 LAN Enterprise licensing (2019), $917,392 of Catalyst 9300 (2022), all Presidio, all with no renewal date. Network Infrastructure is still buying — last PO 2026-06-16. Your entry is not switch-for-switch; it is segmentation and east-west enforcement around the ICMS and SCP builds, where the Cisco estate is the thing being segmented rather than the thing being replaced. Absence of a recent Cisco refresh PO in this record is not evidence they have not refreshed — it may have gone through a statewide vehicle that does not surface here. Ask.
Due Q4 2026, $743,037 spent against $95,822,463 of related budget, 0.8% penetration, early/pilot. This is EDD's published commitment with a deadline inside your selling year, and it sits directly on top of two Yellow-rated projects and a $817,579,560 claims modernization. Frame it as their deadline, not your product. Pair it with SOC-as-a-Service (due each quarter 2026, 1.2% penetration) and the requested "Security Audit Logging and Data Security" BCP — the customer has already written the requirement in their own budget language.
The PA-5250 ($1,368,511, 2021) and Traps ($1,348,490, 2019) both came through Enterprise Networking Sols, who last transacted at EDD 2024-05-09 and is not on your current statewide list. Find out who supports that gear now. If the answer is "nobody clean," that is a renewal you can consolidate onto an authorised partner without a competitive event. One compliance note that applies to any AI-flavoured security pitch: bulletin K-27-24 (2024-06-05) requires a GenAI Disclosure & Factsheet (STD 1000) from contractors on Leveraged Procurement Agreements before award or PO execution. Have it ready before it is asked for.
Situation
Within this scope EDD has written 1,660 POs worth $871,400,008 across 246 suppliers — 27.4% of the department's $3,183,886,936 total. But the money is not where your fight is. Software & Licensing is $775,577,545 of it, dominated by Salesforce work through Outreach Solutions As A ($258,430,679) and Deloitte's consulting paper ($167,800,546). Security & Identity is $77,737,134 across 167 POs, last 2026-06-08. Network Infrastructure is the smallest line in the scope: 130 POs, $18,085,329, last 2026-06-16 — still transacting, but at a scale that says refresh-and-maintain rather than build.
Your own line is present, not absent. Palo Alto runs $32,839,251 from 2017-05-26 to 2026-05-05, and it has moved through five different routes:
- PALO ALTO NETWORKS INC direct — 1 PO, $13,999,999, last 2018-04-23
- ENTERPRISE NETWORKING SOLS INC — 9 POs, $7,509,351, last 2024-05-09
- NWN SOLUTIONS CORPORATION — 2 POs, $5,996,392, last 2025-07-31
- OPTM WEST — 7 POs, $4,860,303, last 2024-05-08
- KOVARUS LLC — 1 PO, $405,227, last 2019-04-12
Read the dates against DGS bulletin K-40-24 (2024-10-15), the award of the current-generation Enterprise Technology statewide contract family replacing 1-19-70-19(A-S). Enterprise Networking Solutions and OPTM West both stop at May 2024. NWN's most recent Palo Alto PO is 2025-07-31. That is an inference, not a stated fact — the bulletin does not say who lost what — but the pattern is consistent with the turnover point re-cutting who could carry the line. Your authorised routes today are only three: NWN Corporation (1-24-70-19-22), Ahead, Inc. dba Kovarus, Inc. in CA (1-24-70-19-19), ePlus Technology Inc. (1-24-70-19-12). Two of the three historic top sellers at EDD are not among them.
The rival OEM. Cisco holds the network layer and holds it through Presidio: CON-SNT-N9336FX2 support at $1,567,390 (2020-05-26), the Nexus 9300 LAN Enterprise license upgrade at $1,227,854 (2019-06-06), Catalyst 9300 48-port UPOE at $917,392 (2022-02-14), plus $189,628 of 10GBASE-CU optics (2021-06-22). None carries a renewal date. That is refresh-relevant age on a switching estate, and it is the incumbent position your line has to be measured against in any campus or datacentre segmentation conversation.
Two secondary seams sit alongside it. Symantec PacketShaper S500 visibility and control, $338,739 through Optiv Security Inc, bought 2019-04-05 — a legacy visibility appliance old enough that whatever replaced it is a question worth asking. NetScout MasterCare support, $401,397 through ePlus Technology Inc, 2020-05-13 — notable because ePlus is one of your three authorised routes and already has an EDD PO history.
Your own aging paper. PAN-PA-5250-AC with redundant AC supply, $1,368,511, bought 2021-05-26 through Enterprise Networking Sols. Traps Advanced Endpoint Protection, tier D, $1,348,490, bought 2019-04-30 through the same reseller. Both are five to seven years old, both were sold by a partner who does not appear on your current statewide list. Whoever is supporting that hardware and whatever replaced Traps is the first thing to establish — it is either an unmanaged renewal sitting in the open or it has already gone somewhere you cannot see.
Where the priority argument sits. EDD's own Envision 2026 scoring shows Zero Trust Architecture due Q4 2026 with $743,037 spent against $95,822,463 of related budget — 0.8% penetration, early/pilot. SOC-as-a-Service & monitoring, due each quarter 2026, sits at $13,562,181 against $1,175,319,718, 1.2%. Those are the openings. Do not walk in pitching identity or backup: Identity & Digital ID is established at $92,631,785 and 10.9% penetration, and Cyber resilience & recovery at $24,678,524 and 15.1%. EDD has demonstrably acted there and will say so.
The department also requested — not received — money that matters to you: a 2025-26 Governor's Budget BCP for "Continuation of Cybersecurity Staffing, Security Audit Logging and Data Security." Audit logging and data security is the language of a SOC/XDR conversation, filed by the customer, before any purchase order. Treat it as sequence evidence, not budget.
What they are about to build
Four projects are in implementation on CDT's published tracker:
| Project | Cost | Oversight |
|---|---|---|
| EDDNext: ICMS / IDM (7100-222) | $817,579,560 | Green |
| Shared Customer Portal (7100-236) | $144,408,060 | Yellow |
| Document Management System (7100-237) | $97,601,364 | Yellow |
| CalJOBS Modernization (7100-234) | $53,887,116 | No Report Available |
Oversight has flagged concerns on SCP and DMS. That is a published rating with a source, not an opinion — but the cause of the rating is not in this data, so name it and ask, never diagnose.
The joins matter more than the numbers. DMS is CORROBORATED: 29 POs worth $48,625,715 in this department already match the project's own name, most recent 2026-03-26. The build is transacting now. And two official filings — the BCP and the IPOR tracker — independently state $97,601,364 for it, so that figure can be cited flat. ICMS is the opposite: the BCP states $834,615,032 while the tracker says $817,579,560, a $17,035,472 gap between two official filings. That gap is a good discovery question, not an argument.
The ICMS delivery vehicle is already signed: Deloitte Consulting LLP, $101,417,506, 2026-02-02 to 2031-02-01, "IT Consulting and Licensing Services — Integrated Claims Management System." Five years. Deloitte is not your competitor as an OEM; it is the systems integrator whose reference architecture will decide what security controls wrap a claims platform holding Californians' wage and identity data. Whoever is in that architecture conversation in 2026 sets the pattern through 2031.
Meanwhile the department has requested more: EDDNext Modernization appears in both the 2025-26 and 2026-27 Governor's Budget BCPs, and a May Revision BCP for "EDDNext Modernization – Document Management System Spring Update." A May Revision request is a late addition — something changed after January. That is worth asking about directly.
And the pressure is dated: $197,273,278 across 60 dated terms ends within 18 months while five BCPs and four pipeline projects are live. Expiring paper and requested money are colliding right now.
Questions to ask
1. The Palo Alto XMDR service ends 2026-06-30 — is the FY26/27 continuation already scoped, and was it shaped in the January budget cycle or is it still open?
2. Who supports the PA-5250 and what replaced Traps? Both came through a reseller that has not transacted here since May 2024.
3. After the October 2024 Enterprise Technology re-award, did EDD have to re-route any in-flight security purchases — and did that change who you can buy Palo Alto from?
4. The Nexus and Catalyst estate has no renewal dates on file. Has that refresh already happened through a statewide vehicle that would not show in departmental POs?
5. Zero Trust is due Q4 2026 in the state strategy and EDD shows 0.8% penetration against related budget — who owns that milestone here, and is it a project or a programme?
6. SCP and DMS are both rated Yellow by oversight. Is any part of that concern architectural — network, segmentation, monitoring — or is it schedule and scope?
7. The DMS BCP and the IPOR tracker both say $97,601,364, but ICMS shows $834,615,032 in the BCP against $817,579,560 on the tracker. Which is the working number, and what moved?
8. On the Deloitte ICMS engagement running to 2031-02-01 — who sets the security reference architecture, EDD or the integrator?
Who to talk to
- Marc Glenn, Chief, Network Operations and Security Center — the single most relevant name in this scope. Owns both the Cisco-held network estate and whatever XDR/SOC arrangement follows the June expiry. Lead here.
- Ajit Girn, Chief Information Officer — the Zero Trust and SOC commitments are departmental, not sectional; the deadline argument lands at CIO level.
- Natalie Branch-Mack, Deputy Chief of Projects & Technology — owns the pipeline side: SCP, DMS, ICMS. This is where an architectural attachment to a $817,579,560 programme is either allowed or not.
- Ben Caldwell, Information Technology Manager 1 — likely the technical validator for anything touching the network and security stack; the person who tells you what is actually still running.
- David Derks, Chief, Client Solutions — relevant only if the conversation moves toward the Shared Customer Portal's user-facing edge.
- Cory Buttler — 46 POs, $76,108,584, most recent 2026-07-28. High count, high value, currently active. Most likely to sign a security or infrastructure renewal.
- Jennifer Araiza — 341 POs, $40,661,209, most recent 2026-07-24. By far the highest PO volume in the scope; this is the routine and renewal desk. Anything recurring goes through here.
- Clay Wolery — 27 POs, $122,822,051, most recent 2026-06-29. Large-value, low-count — the profile of someone handling major agreements.
- Dannielle Lecitona — 11 POs, $195,908,840, most recent 2026-07-01. Highest dollar value in the scope on very few POs; associated with the largest agreements. Reach here only when there is a large-vehicle decision to make.
Route to market
Carry the deal with NWN. They hold statewide Palo Alto award 1-24-70-19-22, they tied for the top ETC score at 918.00 points against $261,900, and they are the only one of your three authorised partners with a current, live Palo Alto contract at EDD ($5,996,392 across 2 POs, last 2025-07-31, plus the $3,585,744 XMDR service ending 2026-06-30). They already own the customer relationship you need to protect.
Keep Kovarus as the credible alternate. Ahead, Inc. dba Kovarus, Inc. in CA holds 1-24-70-19-19 and scored 918.00 at $261,900 — a dead heat with NWN on both price and points. A tie that close means Kovarus is not a distant second; it is a genuine second route and a legitimate partner conversation if NWN's position at EDD weakens. Their EDD Palo Alto history is thin and stale ($405,227, last 2019-04-12), but they carry statewide software-licensing weight — they appear on bulletin K-63-25 as a ServiceNow GenAI promotional-pricing holder, which puts them in front of the software desk you are not otherwise near.
ePlus is the third route, and it has an EDD footprint. 1-24-70-19-12, 899.74 points at $267,650 — behind on both, and the record shows no Palo Alto PO at EDD from them. But they sold the $401,397 NetScout MasterCare support in 2020-05-13, so they have a purchasing relationship in the infrastructure category. Useful if you need a partner without an incumbent renewal to defend.
One risk to watch on NWN. Their winning bid claimed 1.5% DVBE. In a silo decided by a tie at 918.00, preference points are decisive. DGS has removed Small Business certification from two Enterprise Technology contractors in 2026 alone — Mergent Systems Inc (K-14-26, 2026-03-02) and Eyep Solutions Inc (K-04-26, 2026-01-21). Neither is your partner, but the pattern shows DGS is actively pulling certifications. If NWN's DVBE status ever changes, their position in this silo is materially weaker on any re-competition. Confirm it stands before you build the year around them.
Separately: the TDDC services master agreement runs to 2027-04-20 and DGS surveyed the market on 2025-12-12 ahead of a full re-competition of roughly 359 agreements (K-62-25). If any part of the XMDR service is bought as consulting rather than product, that re-competition affects how it renews. Establish which vehicle carries the service, not just the product.
The first 90 days
| What | Who | By when |
|---|---|---|
| Confirm NWN's Palo Alto authorisation under 1-24-70-19-22 is current and their DVBE claim stands | NWN contracts lead | Day 10 |
| Establish what happened to the PA-5250 and Traps estate — support status, replacement, current owner | Ben Caldwell / NWN | Day 20 |
| Map the XMDR contract: which vehicle carries it, who scoped it, when the FY26/27 decision was made | Marc Glenn | Day 20 |
| Ask whether the Cisco Nexus/Catalyst refresh has happened outside departmental POs | Marc Glenn / Ben Caldwell | Day 25 |
| Introduce yourself to Natalie Branch-Mack on SCP/DMS architecture, not product | Rep direct | Day 30 |
Success by day 30: you can name, on paper, who owns the Zero Trust Q4 2026 milestone at EDD and which vehicle the 2026-06-30 XMDR contract renews under.
| What | Who | By when |
|---|---|---|
| Draft initiative 1: consolidate all Palo Alto support and licensing onto a single authorised route ahead of the 2026-06-30 expiry | Marc Glenn, NWN, Cory Buttler | Day 45 |
| Draft initiative 2: a segmentation and east-west enforcement design scoped to the ICMS and SCP environments, framed against EDD's own Q4 2026 Zero Trust commitment | Natalie Branch-Mack, Ajit Girn | Day 50 |
| Draft initiative 3: SOC/audit-logging expansion, written in the language of the requested "Continuation of Cybersecurity Staffing, Security Audit Logging and Data Security" BCP — described as a request, never as funding | Marc Glenn | Day 55 |
| Prepare STD 1000 GenAI disclosure material (K-27-24) for any AI-assisted detection component | NWN compliance | Day 60 |
Success by day 60: at least two of the three initiatives are restated back to you by an EDD manager in their own words, with a named internal owner.
| What | Who | By when |
|---|---|---|
| Diarise 2026-06-30 — XMDR term end. Establish now whether it renews, re-competes or lapses | Cory Buttler / Jennifer Araiza | Day 65 |
| For each initiative, fix the nine facts: requirement owner, technical champion, executive sponsor, buyer of record, contract vehicle, OEM authorisation, budget source, likely procurement date, incumbent | Rep + NWN | Day 80 |
| Confirm with Deloitte's EDD engagement whether the ICMS security reference architecture is set by EDD or the integrator | Natalie Branch-Mack | Day 85 |
| Decide route: NWN as primary; Kovarus briefed as alternate if the DVBE or relationship position moves | Rep direct | Day 90 |
Success by day 90: one initiative has a named buyer of record, a confirmed vehicle, and a procurement date inside the next two fiscal quarters — recorded, not assumed.
What this rests on
- This is a purchase record, not an install base. The Cisco Nexus and Catalyst lines show what was bought in 2019-2022; they do not show what is racked today, and the absence of a recent refresh PO is a question about buying route, not proof the estate is stale.
- The link between DGS bulletin K-40-24 and the disappearance of Enterprise Networking Solutions and OPTM West from EDD's Palo Alto history after May 2024 is my inference from date alignment. The bulletin does not name winners or losers. Confirm it with NWN before repeating it in front of a customer.
- Statewide priority theme spend is keyword-matched. The $743,037 Zero Trust figure establishes that little has been tagged that way, not that no Zero Trust work exists. EDD may run the programme under a name these records do not use — ask, do not assert.
- The CDT pipeline entries are stated intent with published oversight ratings, and the BCPs are requests to the Legislature. Neither is money that exists. The Yellow ratings on SCP and DMS are confirmed facts; their causes are not in this data.
- ETC bid data says who is allowed to sell Palo Alto to the state and how hard they fought for it. It is not revenue. Kovarus holds the paper and has one EDD PO from 2019 — that is a real finding about a partner who can transact but currently does not.