10.11.2026

Software Security Ambassadors Scheme

Championing Secure Software Development for a Resilient Cyber Ecosystem

The UK Government is stepping up efforts to strengthen the country’s cyber security by encouraging organisations to make software development more secure. Through its Software Security Ambassadors Scheme, the Department for Science, Innovation and Technology (DSIT), working alongside the National Cyber Security Centre (NCSC), is promoting better software security practices and more resilient digital supply chains.

The initiative aims to reduce vulnerabilities in software, improve transparency between suppliers and customers, and make the UK’s digital infrastructure more resistant to cyber-attacks.

Tackling the Growing Threat of Software Supply Chain Attacks

Software is fundamental to modern businesses, public services and critical infrastructure. However, weaknesses in software development, third-party components and maintenance processes can provide opportunities for cyber criminals to infiltrate organisations.

The scale of the problem is significant. Government figures indicate that 59% of organisations experienced a software supply chain attack in the previous year. Such incidents can affect multiple businesses simultaneously, particularly when widely used software or services are compromised.

The Government believes that improving security at the development stage, rather than simply responding to attacks afterwards, is essential to reducing these risks.

The Software Security Code of Practice

At the heart of the initiative is the Government’s voluntary Software Security Code of Practice, which sets out 14 principles across four key areas:

– Secure design and development: Building security into software from the earliest stages, including secure coding, testing and risk assessment.

– Build environment security: Protecting the systems and processes used to create and distribute software.

– Secure deployment and maintenance: Ensuring software remains protected through updates, ongoing maintenance and vulnerability management.

– Communication with customers: Providing organisations with clear information about security risks, vulnerabilities and incidents.

The Code encourages software suppliers to adopt recognised security frameworks, understand the components used in their products and make secure settings the default.

Creating a Network of Software Security Ambassadors

A major part of the policy is the creation of a network of Software Security Ambassadors. Participating organisations agree to promote the Code of Practice, demonstrate how its recommendations can be implemented and share examples of successful security improvements.

The scheme brings together software developers, technology suppliers, organisations that purchase software and specialist cyber security advisers.

Signatories are also encouraged to appoint senior managers responsible for overseeing software security, provide appropriate staff training and publish self-assessments or independent verification of their progress.

The scheme launched in January 2026, with a second group of participating organisations announced in October. Organisations involved include Accenture, Cisco, Lloyds Banking Group, NCC Group, Palo Alto Networks, Santander and Sage, alongside the DSIT and NCSC.

Building a More Resilient Digital Future

The Government’s approach recognises that cyber security is a shared responsibility. Software developers must take greater responsibility for the security of their products, while businesses purchasing software need to consider security when selecting and managing suppliers.

Although the Code is voluntary, the Ambassador Scheme is intended to encourage wider adoption through industry leadership, collaboration and practical examples.

Ultimately, the initiative aims to create a stronger and more transparent software industry, reducing the likelihood of supply chain attacks and helping organisations across the UK operate with greater confidence in the technology they depend upon.

Further Information

To read the gov.uk policy paper: Software Security Ambassadors Scheme, go to: www.gov.uk/software-security-ambassadors-scheme