The NDAA Trap: How Annual Authorization Cycles Quietly Dictate Defense Tech Investment Timing

Every September, a version of this conversation happens in at least a dozen defense tech board rooms: a startup has strong traction with a program office, a sympathetic colonel, and a capability that genuinely fills a gap. Then the fiscal year turns, the continuing resolution kicks in, and the contracting officer who loved them has no new obligation authority. The deal slips. The runway burns. The founders wonder what went wrong.

Photo by Somchai Kongkamsri on Pexels.

What went wrong is that nobody mapped the NDAA.

The National Defense Authorization Act is not, strictly speaking, a procurement vehicle. It doesn't cut checks. What it does is set the policy conditions under which DoD can spend money, authorize new program starts, establish acquisition authorities, and in some cases name specific programs or capabilities for investment. Understanding that distinction matters enormously if you're timing entry points into a position or evaluating whether a startup's government revenue thesis has legs in the next 18 months.

Most VCs treat the NDAA as a news event. A provision gets added that mentions unmanned systems or directed energy, and suddenly every generalist fund with a defense-adjacent portfolio sends a breathless memo about the tailwind. That's not how to use this document. The smarter play is to read it as a forward indicator of where obligation authority will concentrate two to three fiscal years out.

Here's the basic flow worth understanding:

graph TD
    A[NDAA Enacted] --> B(Authorization Language Issued)
    B --> C{Appropriations Passed?}
    C -->|Yes| D[Program Office Gets Obligation Authority]
    C -->|No| E[Continuing Resolution]
    E --> F(Flat-Rate Spending, No New Starts)
    D --> G[Contracting Window Opens]
    F --> G

The continuing resolution problem is the one that kills defense tech startups on otherwise reasonable timelines. Congress authorizes. Then it fails to appropriate on time, often by months. Under a CR, DoD generally cannot start new programs or obligate funds above prior-year rates. A startup that has spent six months closing a contract can watch that contract evaporate because the program office literally lacks the legal authority to sign. This is not a bug in the system someone forgot to fix. It's a structural feature of how the federal budget works, and it recurs with depressing regularity.

For investors, this means a few things concretely.

First, the NDAA's authorization language telegraphs where program offices will seek to spend money, often 12 to 24 months before contracts actually flow. A provision directing DoD to establish a new program element for counter-UAS capabilities in FY2026 won't generate contracts in FY2026. The program element has to get stood up, the requirements have to get written, the acquisition strategy has to get approved. You're looking at FY2027 or FY2028 for serious obligation authority. Invest accordingly.

Second, specific NDAA sections create new acquisition pathways that can dramatically shorten a startup's time to contract. Section 804 and 806 authorities, the Middle Tier Acquisition pathway, and various rapid prototyping provisions have all been expanded and modified over recent cycles. When a new authority gets written into law, the program offices that want to move fast now have legal cover. That's a real signal. Track which authorities get expanded in each cycle and match them against your portfolio companies' acquisition strategies.

Third, the NDAA's report requirements matter almost as much as its authorization language. Congress frequently directs DoD to submit reports on specific capability gaps, often as a precursor to eventual authorization. These reports are publicly available. They're also extremely tedious to read. That tediousness is the moat. The investor who reads the report on the DoD's microelectronics sourcing vulnerabilities in January will have a sharper view of where contract dollars will flow than one who waits for the press coverage.

Timing your investment relative to NDAA cycles is not about chasing the legislative calendar like a lobbyist. It's about understanding that a startup's government revenue doesn't follow a commercial sales cycle. The customer's ability to spend is constrained by a political and legal process that moves on its own schedule, regardless of product readiness or customer enthusiasm.

The founders who understand this stop treating contract delays as execution failures. They model them in. They build runway assumptions that account for the possibility of a CR extending three or four months into the fiscal year. They target program offices with existing program elements rather than requiring new starts. They know which acquisition authorities apply to their deal size and scope.

The investors who understand this stop getting surprised when a promising portfolio company reports a pushed contract. They built that slip into the model. They know that the slip is not the story. The story is whether the authorization language that matters to this company is getting stronger or weaker with each new NDAA cycle.

Read the bill. All of it. Not just the summary.