Skip to content
You can now search across every topic, entity and event.What's new
Cybersecurity: Threats and Defences
30APR

NCSC ships SilentGlass, its first commercial product

3 min read
08:16UTC

NCSC launched SilentGlass on 22 April: the first commercial hardware to carry NCSC branding, manufactured with Sony UK Technology Centre and licensed to Goldilock Labs.

TechnologyDeveloping
Key takeaway

NCSC adds a commercialisation lever in the same week UK cyber capability moved outside UK control.

The UK National Cyber Security Centre (NCSC) launched SilentGlass mid-week, the first commercial hardware product ever to carry NCSC branding 1. The device blocks HDMI and DisplayPort hardware-injection attacks, the physical-cable paths that bypass software defences entirely, and is already deployed in UK government high-threat environments. Sony UK Technology Centre at Pencoed manufactures the unit; Goldilock Labs holds the global commercial distribution licence.

The launch matters less for the device's specification and more for the policy template it establishes. NCSC has historically been an attribution and advisory body, not a commercial vendor; SilentGlass moves a piece of UK government intellectual property into the open market under licence. Goldilock Labs carries the channel and warranty exposure; Sony UK Technology Centre carries the manufacturing scale; NCSC keeps the IP rights. The structure means the commercial ramp does not require any new procurement or trading authority inside the agency.

NCSC's launch timing carries the political read. SilentGlass lands inside the same week as the Beazley Swiss acquisition and the Airbus absorption of Ultra Cyber, two transactions that move UK cyber capability outside UK consolidated control. NCSC simultaneously demonstrates that the public sector can monetise its IP into the commercial channel without ceding ownership. NCSC, fresh from co-signing the FSB Star Blizzard advisory with AIVD , now adds a hardware product line to the same agency footprint, with the UK Cyber Security and Resilience Bill baseline supplying the regulatory floor on which products like SilentGlass become procurement-defensible inside operator estates. For policy readers, the question is whether SilentGlass becomes a one-off press release or the first item in a recurring NCSC commercial pipeline.

Deep Analysis

In plain English

Hackers with physical access to HDMI or DisplayPort cables, the connectors between computers and screens, can inject malicious signals that bypass all software security controls. NCSC, the UK government's cybersecurity agency, developed SilentGlass to block that class of attack. Sony UK Technology Centre manufactures the device; Goldilock Labs sells it commercially. NCSC has deployed SilentGlass in UK government high-threat environments and licensed it to Goldilock Labs for sale to private-sector organisations.

What could happen next?
  • Precedent

    SilentGlass establishes a structure for NCSC and other GCHQ-adjacent bodies to license government-developed IP into commercial products without placing the government entity in the commercial product-liability chain.

  • Opportunity

    UK cyber product companies with technology adjacent to government-developed IP should evaluate licensing structures with NCSC, given that the SilentGlass model is now a demonstrated precedent.

First Reported In

Update #2 · FIRESTARTER puts Cisco below the patch line

NCSC UK· 30 Apr 2026
Read original
Different Perspectives
Group-IB
Group-IB
Group-IB, headquartered in Singapore, documented on 19 March that The Gentlemen began inside Qilin's own affiliate programme and split from it over a payment dispute. Its analysis makes this window's leak-site tally readable as a fracture inside one ransomware operation rather than the arrival of an unknown crew.
ENISA
ENISA
ENISA placed EU drinking water and wastewater in its cyber risk zone for the first time on 28 May, finding one in three water entities had never run a risk assessment. CISA's 30 July advisory to American operators reads as the operational sequel to a gap European regulators had already documented two months earlier.
House of Lords and NCSC
House of Lords and NCSC
The Cyber Security and Resilience Bill sits at House of Lords committee stage, its amendment paper running to 23 July. Separately, the NCSC guidance CISA cited when directing water operators to disconnect controllers is version 1.0 from March 2024, a two-year-old British document doing operational work in an American alert published last week.
heise online
heise online
heise online reported on 27 July that Russian state attackers, named as APT28, ran the hotel WiFi credential-harvesting campaign. Its attribution is firmer than ReliaQuest's own hedged low-to-medium confidence assessment of the same intrusion, a difference in national reporting posture rather than a settled dispute over who is responsible.
CISA and ReliaQuest
CISA and ReliaQuest
CISA compressed remediation deadlines under BOD 26-04 while, in the same window, telling water and wastewater operators to disconnect internet-exposed controllers rather than patch them. ReliaQuest, investigating the hotel WiFi campaign, held its assessment of the intrusion route at low-to-medium confidence and declined to name a state sponsor.
AIVD
AIVD
AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.