Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
Cybersecurity: Threats and Defences
30APR

NCSC ships SilentGlass, its first commercial product

3 min read
08:16UTC

NCSC launched SilentGlass on 22 April: the first commercial hardware to carry NCSC branding, manufactured with Sony UK Technology Centre and licensed to Goldilock Labs.

TechnologyDeveloping
Key takeaway

NCSC adds a commercialisation lever in the same week UK cyber capability moved outside UK control.

The UK National Cyber Security Centre (NCSC) launched SilentGlass mid-week, the first commercial hardware product ever to carry NCSC branding⁠1. The device blocks HDMI and DisplayPort hardware-injection attacks, the physical-cable paths that bypass software defences entirely, and is already deployed in UK government high-threat environments. Sony UK Technology Centre at Pencoed manufactures the unit; Goldilock Labs holds the global commercial distribution licence.

The launch matters less for the device's specification and more for the policy template it establishes. NCSC has historically been an attribution and advisory body, not a commercial vendor; SilentGlass moves a piece of UK government intellectual property into the open market under licence. Goldilock Labs carries the channel and warranty exposure; Sony UK Technology Centre carries the manufacturing scale; NCSC keeps the IP rights. The structure means the commercial ramp does not require any new procurement or trading authority inside the agency.

NCSC's launch timing carries the political read. SilentGlass lands inside the same week as the Beazley Swiss acquisition and the Airbus absorption of Ultra Cyber, two transactions that move UK cyber capability outside UK consolidated control. NCSC simultaneously demonstrates that the public sector can monetise its IP into the commercial channel without ceding ownership. NCSC, fresh from co-signing the FSB Star Blizzard advisory with AIVD, now adds a hardware product line to the same agency footprint, with the UK Cyber Security and Resilience Bill baseline supplying the regulatory floor on which products like SilentGlass become procurement-defensible inside operator estates. For policy readers, the question is whether SilentGlass becomes a one-off press release or the first item in a recurring NCSC commercial pipeline.

Deep Analysis

In plain English

Hackers with physical access to HDMI or DisplayPort cables, the connectors between computers and screens, can inject malicious signals that bypass all software security controls. NCSC, the UK government's cybersecurity agency, developed SilentGlass to block that class of attack. Sony UK Technology Centre manufactures the device; Goldilock Labs sells it commercially. NCSC has deployed SilentGlass in UK government high-threat environments and licensed it to Goldilock Labs for sale to private-sector organisations.

What could happen next?
  • Precedent

    SilentGlass establishes a structure for NCSC and other GCHQ-adjacent bodies to license government-developed IP into commercial products without placing the government entity in the commercial product-liability chain.

  • Opportunity

    UK cyber product companies with technology adjacent to government-developed IP should evaluate licensing structures with NCSC, given that the SilentGlass model is now a demonstrated precedent.

First Reported In

Update #2 · FIRESTARTER puts Cisco below the patch line

NCSC UK· 30 Apr 2026
Read original →
Different Perspectives
ENISA
ENISA
ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.
LKA Hamburg
LKA Hamburg
Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.
ASOS
ASOS
ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.
Check Point
Check Point
Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.
Japan's National Police Agency
Japan's National Police Agency
Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.
CISA
CISA
CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.