Skip to content
Briefings are running a touch slower this week while we rebuild the foundations.See roadmap
Cybersecurity: Threats and Defences
30APR

NCSC ships SilentGlass, its first commercial product

3 min read
08:16UTC

NCSC launched SilentGlass on 22 April: the first commercial hardware to carry NCSC branding, manufactured with Sony UK Technology Centre and licensed to Goldilock Labs.

TechnologyDeveloping
Key takeaway

NCSC adds a commercialisation lever in the same week UK cyber capability moved outside UK control.

The UK National Cyber Security Centre (NCSC) launched SilentGlass mid-week, the first commercial hardware product ever to carry NCSC branding 1. The device blocks HDMI and DisplayPort hardware-injection attacks, the physical-cable paths that bypass software defences entirely, and is already deployed in UK government high-threat environments. Sony UK Technology Centre at Pencoed manufactures the unit; Goldilock Labs holds the global commercial distribution licence.

The launch matters less for the device's specification and more for the policy template it establishes. NCSC has historically been an attribution and advisory body, not a commercial vendor; SilentGlass moves a piece of UK government intellectual property into the open market under licence. Goldilock Labs carries the channel and warranty exposure; Sony UK Technology Centre carries the manufacturing scale; NCSC keeps the IP rights. The structure means the commercial ramp does not require any new procurement or trading authority inside the agency.

NCSC's launch timing carries the political read. SilentGlass lands inside the same week as the Beazley Swiss acquisition and the Airbus absorption of Ultra Cyber, two transactions that move UK cyber capability outside UK consolidated control. NCSC simultaneously demonstrates that the public sector can monetise its IP into the commercial channel without ceding ownership. NCSC, fresh from co-signing the FSB Star Blizzard advisory with AIVD , now adds a hardware product line to the same agency footprint, with the UK Cyber Security and Resilience Bill baseline supplying the regulatory floor on which products like SilentGlass become procurement-defensible inside operator estates. For policy readers, the question is whether SilentGlass becomes a one-off press release or the first item in a recurring NCSC commercial pipeline.

Deep Analysis

In plain English

Hackers with physical access to HDMI or DisplayPort cables, the connectors between computers and screens, can inject malicious signals that bypass all software security controls. NCSC, the UK government's cybersecurity agency, developed SilentGlass to block that class of attack. Sony UK Technology Centre manufactures the device; Goldilock Labs sells it commercially. NCSC has deployed SilentGlass in UK government high-threat environments and licensed it to Goldilock Labs for sale to private-sector organisations.

What could happen next?
  • Precedent

    SilentGlass establishes a structure for NCSC and other GCHQ-adjacent bodies to license government-developed IP into commercial products without placing the government entity in the commercial product-liability chain.

  • Opportunity

    UK cyber product companies with technology adjacent to government-developed IP should evaluate licensing structures with NCSC, given that the SilentGlass model is now a demonstrated precedent.

First Reported In

Update #2 · FIRESTARTER puts Cisco below the patch line

NCSC UK· 30 Apr 2026
Read original
Different Perspectives
Norwegian Security and Service Organisation
Norwegian Security and Service Organisation
NSSO was a prior victim of Ivanti EPMM zero-days and now faces CVE-2026-6973 in the same product line. Ivanti's position that on-premises EPMM is the only affected tier provides limited reassurance to a government body that has already been compromised twice via the same vendor's MDM infrastructure.
ENISA and EU CNA Ecosystem
ENISA and EU CNA Ecosystem
ENISA onboarded four new CVE Numbering Authorities under ENISA Root on 6 May, expanding EU-sovereign vulnerability disclosure infrastructure in the same week three critical CVEs entered the CISA KEV catalogue. Greater CNA coverage inside the EU reduces dependence on US-anchored MITRE for European-sourced vulnerability identifiers.
German Federal Office for Information Security (BSI)
German Federal Office for Information Security (BSI)
BSI rated CVE-2026-41940 in cPanel 'very high', reflecting Germany's exposure across shared-hosting infrastructure for Mittelstand businesses. The 65-day zero-day window and the amplification effect of cPanel's multi-tenancy model mean the BSI rating applies to thousands of German SME websites hosted on affected servers.
Republic of Korea National Intelligence Service
Republic of Korea National Intelligence Service
South Korea's NIS tracks UNC1069's tooling evolution; the CSIS paper argues the ROK's intelligence on DPRK cyber operations should feed joint US-ROK situational awareness rather than bilateral channels that move too slowly for real-time supply-chain response.
Democratic People's Republic of Korea
Democratic People's Republic of Korea
UNC1069's Axios operation scales North Korea's supply-chain access from niche Python packages to the most downloaded HTTP client in the JavaScript ecosystem. WAVESHAPER.V2 provides persistent access to development environments where cryptocurrency wallets and API keys are stored, serving the sanctions-evasion funding logic behind earlier DPRK toolchain operations.
WatchTowr Labs
WatchTowr Labs
WatchTowr Labs disclosed CVE-2026-41940 after the 28 April patch shipped, providing the 65-day exploitation timeline from KnownHost telemetry. The disclosure is textbook; the open question is why WebPros did not catch the cpsrvd CRLF class flaw before external researchers found it under active exploitation.