Loading story…
Dragonfly and the UCL School of Management secured £704,863 from Innovate UK for an 18-month project to improve how organisations assess software security across entire technology stacks. The initiative will build a secure stack advisory layer designed to evaluate interconnected software components, trace data flows across tool boundaries, identify weak links and shadow IT exposure, and map findings to the UK Software Security Code of Practice and other relevant standards.
The project is intended to address rising cyber risk tied to growing software complexity and the rapid expansion of AI-enabled application use, which have made manual compliance and compositional risk reviews increasingly difficult for businesses. Dragonfly is contributing a knowledge graph covering 300,000 vendors, while UCL researchers will provide expertise in optimisation, machine learning, and decision-making under uncertainty, aligning with broader UK concern over the economic impact of cyber attacks on organisations.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
The 18-month Dragonfly-UCL project is set to begin in August 2026, building a secure stack advisory layer and compositional risk engine using Dragonfly's vendor knowledge graph and UCL research expertise.
Dragonfly launched as a company, prior to the later Innovate UK-funded collaboration with UCL on software stack security assessment.
The UK government released the Software Security Code of Practice, which later became a framework the Dragonfly-UCL project aims to support and cross-map against other standards.
Dragonfly and the UCL School of Management secured £704,863 from Innovate UK under the Secure Software for Resilient Growth competition to improve software security assessment. The project is intended to help organisations assess whole software stacks, detect weak links and shadow IT exposure, and map findings to the UK Software Security Code of Practice and other standards.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK government has published a voluntary **Software Security Code of Practice** aimed at improving the security and resilience of software supplied to businesses and reducing software supply chain risk. Co-designed by the **National Cyber Security Centre (NCSC)** with industry and academic experts, the code sets out **14 principles** across four areas: secure design and development, build environment security, secure deployment and maintenance, and communication with customers. It is primarily targeted at senior leaders in software vendor organizations, who are expected to appoint a **Senior Responsible Owner** to drive implementation and accountability. Alongside the code, the NCSC released **Assurance Principles and Claims** guidance to help vendors self-assess whether they meet a baseline level of software security and resilience. The assessment framework covers controls such as secure development practices, third-party component management, testing, threat modelling, build environment access control, vulnerability disclosure, patching, and customer notification, with evidence drawn from documentation, interviews, and audits. The government said the code has been aligned where possible with international frameworks including the **US Secure Software Development Framework** and the **EU Cyber Resilience Act**, and is being supported with implementation guidance, a self-assessment form, and plans for a future certification scheme.
Aug 1, 2026
The UK National Cyber Security Centre and the Department for Science, Innovation and Technology have outlined **Cyber Shield**, a sovereign cyber defense initiative designed to use agentic AI to find and counter weaknesses across government networks and critical national infrastructure. The program is intended to address rising threats from hostile states, organized crime, and AI-enabled attackers that can accelerate reconnaissance and vulnerability discovery to machine speed, while many organizations still face basic security gaps such as unpatched systems, legacy technology, and weak access controls. Cyber Shield is being designed around federated **red-team** and **blue-team** AI agents that can probe for vulnerabilities, share insights, detect threats, and eventually help automate remediation under the control of infrastructure owners. The NCSC said some building blocks, including automated scanning, already exist, but fully autonomous mitigation will require further research, testing, and oversight. Early work will focus on trials with government and critical-sector defenders, with longer-term goals including national-scale scanning, coordinated blocking of known malicious infrastructure, and commercially scalable capabilities developed with industry, academia, AI providers, and critical infrastructure operators.
Aug 11, 2026
European and national cyber authorities are warning that AI is rapidly increasing the speed and scale of vulnerability discovery and exploit development, raising the prospect of a sustained remediation crisis. The European Central Bank told about 110 major banks to assess AI-enabled cyber threats and submit action plans by **October 31, 2026**, while the European Systemic Risk Board and European Supervisory Authorities issued parallel warnings on systemic risk from frontier AI models. In France, ANSSI Director General Vincent Strubel told senators that AI-assisted discovery could create a multi-year **"patch wall"**, overwhelming remediation teams even as basic controls such as network segmentation, identity and access management, and timely patching remain the most effective defenses. Industry reporting and vendor disclosures show why regulators are escalating. Mozilla said frontier AI models helped identify **271 vulnerabilities** fixed in Firefox 150 after an earlier run found 22 security-sensitive bugs, while researchers and commentators say LLM-assisted patch diffing can shrink the path from a disclosed `CVE` to a working proof of concept to days or even hours, including for flaws such as `CVE-2025-32433` in Erlang/OTP SSH. At the same time, access controls around advanced cyber-capable models are tightening unevenly: Anthropic expanded its restricted **Project Glasswing** program for Claude Mythos to critical-infrastructure organizations, but open-weight alternatives such as Zhipu AI's **GLM-5.2** are reported to deliver competitive vulnerability-finding performance at lower cost, reinforcing concerns that powerful offensive-relevant capability is spreading faster than most enterprises can patch.
Jul 10, 2026