.png)
November 4, 2026
・
30
mins read
Risk Ledger has joined the second cohort of the UK Government's Software Security Ambassador Scheme as an expert advisor, committing to promote the Software Security Code of Practice across its supply chain network of more than 20,000 organisations.
Risk Ledger is putting its supply chain network of now more than 20,000 organisations behind the government's work to raise software security standards across UK supply chains. We have joined the second cohort of the Software Security Ambassadors scheme, announced by the Department for Digital, Culture, Media and Sport (DCMS) and the National Cyber Security Centre (NCSC) on 3 November 2026, as an expert advisor. Others in the cohort include Capgemini, Fortinet, QinetiQ, SANS Institute, Thales and Zscaler.
For us, this is part of a longer commitment. Risk Ledger’s mission is to secure supply chains globally, and as a UK-founded company we have long supported the government’s work to secure Britain’s digital supply chains. Neither can be done one organisation at a time.
“We are pleased to have joined the second cohort of the UK Government’s Software Security Ambassador Scheme. As an expert advisor, we’ve committed to promote the Code across the Risk Ledger network of more than 20,000 organisations, help buyers and suppliers put it into practice, and share what we learn with DCMS and the NCSC.
“Organisations that share suppliers, share risk. A common standard makes that risk easier to manage together. This is the foundational principle that Risk Ledger was built on and advocates for: the transition from siloed to collaborative TPRM. Because no single organisation can manage supply chain risk on its own.”
Why software security is a supply chain problem
Almost every organisation in the UK depends on software it did not create itself. If that software has a weakness, every organisation using it is exposed, along with everyone who depends on them.
The risk that is the hardest to detect often sits several steps removed, inside a supplier's supplier. A council, a hospital trust and a government department may use different suppliers, but those suppliers can all rely on the same software provider. If that provider has a weakness, all three are exposed at the same time.
Most organisations still manage this challenge one supplier at a time. Each sends its own questionnaire and in its own format. Suppliers answer the same questions many times over, and buyers receive back evidence that is hard to compare between suppliers and can be out of date fast.
A shared standard for the whole market
The Software Security Code of Practice provides buyers and suppliers with one baseline that everyone recognises. It sets out 14 voluntary principles across four themes: secure design and development, build environment security, secure deployment and maintenance, and communication with customers.
Buyers get a clear standard to ask their software suppliers to meet, and suppliers get a recognised way to show that they meet it.
The Ambassador Scheme supports adoption of the Code across the market by showing how it works in practice and feeding lessons back to the government.
Our role as an expert advisor
Expert advisors help other organisations adopt the Code. Over the next 12 months, we have committed to:
- promote the Code through our work with customers, suppliers and partners
- build it into requirements for the organisations we work with, where it applies
- share real examples of how buyers and suppliers are putting it into practice
- give DCMS and the NCSC feedback as they develop options for a certification scheme
We start from a strong position. Risk Ledger has embedded the Code into its platform, so the buyers and suppliers on our network can work with it directly.
What we are building
Risk Ledger exists to change how Britain's supply chains are secured: from each organisation assessing its suppliers alone, to organisations gaining visibility into and reducing shared risk together.
More than 20,000 organisations now sit on the Risk Ledger network, across financial services, insurance, critical national infrastructure, and central and regional government. Each supplier completes one standardised assessment and keeps it current, replacing repeated questionnaires with one profile that every connected organisation can see. As more organisations join, the picture becomes clearer for everyone on the platform.
The emerging picture extends well beyond direct suppliers. Because connections are mapped across the network, organisations can see the fourth, fifth and nth parties their suppliers depend on, and where concentration risks within that extended ecosystem may reside. Our ambition is for Britain's digital supply chains to be secured collaboratively, not organisation by organisation. A weakness in a widely used supplier should be spotted early, understood by everyone it affects, and fixed at once.
The Code brings that vision closer into view. When suppliers evidence their security postures against the same baseline and buyers ask for it consistently, that evidence can be shared rather than rebuilt from scratch every time for each customer, and security teams can spend their time reducing risk instead of collecting answers.
Working with government
Public sector organisations often depend on the same suppliers, and those suppliers rely on the same providers underneath them. That creates concentration risk: when many organisations rely on the same supplier, a single incident there can disrupt many public services at once.
We work with government communities to map their extended supply chains together, find those shared dependencies, and coordinate a response when a common supplier is hit.
This work started with the COVID-19 Test and Trace programme. The team had chosen two suppliers for a critical testing reagent, so one could take over if the other failed. Mapping on Risk Ledger showed that both relied on the same fourth party. The redundancy they thought they had built did not exist, and the team was able to fix it.
Today, 31 government bodies map their supply chains together on Risk Ledger. Between them, they connect to 2,499 direct suppliers. Through those suppliers’ own connections, the combined map shows a further 4,617 dependencies: 2,539 fourth parties and 2,078 nth parties.
That shared view has identified 928 potential concentration risks, where several government bodies rely on the same company: 289 among direct suppliers, 88 at fourth-party level and 551 further down the chain. Members have rated 139 of the direct-supplier risks as critical, meaning an incident at that supplier would be likely to disrupt essential services at several government organisations at once.
This is what we mean by Defend as One: organisations that share suppliers can see shared risk and act on it together, rather than each finding it alone.
“Supply chain security is a shared problem, and no organisation can solve it alone. Risk Ledger was built on the idea that collaboration across supply chains makes everyone more secure, so joining the Software Security Ambassador Scheme is a natural step for us. We already work closely with central government to map exposure to supply chain risk and to track and promote adoption of key initiatives such as Cyber Essentials and the NCSC’s Early Warning service. Having recently embedded the Software Security Code of Practice into our platform, helping to promote it was an obvious next step.”
Why it matters now
The Code's focus is on security built into software from the start, rather than something to be fixed in the future. That focus matters more as the time between a vulnerability being identified and being exploited is getting shorter. Justin Kuruvilla added:
“Supply chain dependencies continue to amplify the impact of cyber threats, and AI is now accelerating vulnerability discovery and exploitation faster than ever. That makes it more important than ever that security is built into software from the start. Schemes like this are one of the most effective ways we have to drive that change, and we’re proud to work alongside DCMS to help organisations understand the Code, adopt it and hold their suppliers to it.”
Find out more
- Software Security Ambassadors Scheme (GOV.UK)
- Cohort 2 signatories (GOV.UK)
- Software Security Code of Practice (GOV.UK)
About Risk Ledger
Risk Ledger is a supply chain security platform for security and risk teams, working to secure Britain's digital supply chains. Suppliers keep one security profile and share it with many customers. Customers get reusable supplier evidence, visibility of their extended supply chain, and insight into concentration risk. Founded in 2018 and headquartered in the UK, with a US arm, Risk Ledger works with more than 20,000 private and public sector organisations to strengthen the supply chains they share.
.svg)
