Qurexa Logo
Qurexa

Trust. Care. Deliver.

Back to Blog & Insights
Technology

59% were attacked through their software suppliers, and the government's answer is a voluntary code

Qurexa Editorial Team4 November 20267 min read 0 0
59% were attacked through their software suppliers, and the government's answer is a voluntary code

What happened

On 3 November 2026, the Department for Science, Innovation and Technology (DSIT) updated its policy paper on the Software Security Ambassadors Scheme to add the scheme's group 2 signatories. The scheme itself is not brand new. It was announced on 6 January 2026 as part of the Government Cyber Action Plan, and launched on 15 January 2026. The second group launched on 29 October 2026, and the list of who is in it has now been published. The scheme supports something called the Software Security Code of Practice. That code is a voluntary set of principles. Its stated aim is to reduce software supply chain attacks and disruption, and to improve cyber resilience across the economy. The organisations who sign up as ambassadors agree to work with government to promote the Code of Practice across different sectors. The reason given for all of this is one statistic, and it is a striking one. DSIT says that more than half, 59%, of organisations experienced a software supply chain attack in the past year.

Why this matters

A software supply chain attack works differently from the kind of hacking most people picture. The attacker does not try to break into you. They break into something you already trust and already let into your systems. That might be a piece of software you buy, a plug-in your website uses, a code library your developers rely on, or an IT supplier with remote access to your network. Once they are inside something trusted, your defences are largely beside the point. You installed the update yourself. This is why DSIT's framing is about the economy rather than individual companies. As the department puts it, software is a core part of the technology that businesses rely on, and weaknesses in software can cause serious disruption to supply chains and to essential public services. The UK has had plenty of practical demonstrations of this. Attacks on suppliers have disrupted hospitals, retailers, local councils and logistics firms, often because one supplier sat behind many organisations at once. For a small business, the uncomfortable implication is that your cyber security is partly determined by decisions made by companies you have never spoken to. You cannot audit the whole chain. What you can do is choose suppliers who take it seriously, and the point of a visible code of practice is to make that choice slightly easier.

What the evidence actually says

Two things here deserve a closer look: the number, and the mechanism. First, the 59% figure. It comes from DSIT's own policy paper and is quoted as organisations experiencing a software supply chain attack in the past year. That is a very high number, and it is high partly because of how broadly "software supply chain attack" can be defined. It can include an attempted compromise that was caught, not only a successful breach. It also depends on organisations recognising and reporting such an incident, which larger organisations with security teams are far better placed to do than a six-person firm. So treat it as evidence of a widespread and serious problem rather than a precise count of successful break-ins. Second, the mechanism. The Software Security Code of Practice is voluntary. Signing up as an ambassador means agreeing to promote it. Neither of those things is enforcement. That is a fair criticism, and it is worth naming rather than glossing over. A voluntary code relies on reputation and commercial pressure rather than penalties. Its value depends on enough significant buyers asking suppliers whether they follow it. In fairness, it is not the government's only lever. DSIT has also been progressing the Cyber Security and Resilience (Network and Information Systems) Bill, whose factsheets were updated on the same day, and which is aimed at putting firmer duties on operators of important services. There is also the longer-established Cyber Essentials certification scheme, which gives smaller organisations a concrete, checkable baseline. The honest reading is that the ambassadors scheme is an awareness and norm-setting measure sitting alongside harder tools, and should be judged as that.

Qurexa perspective

We handle sensitive information about people's health and medicines, so software supply chain risk is not an abstract topic for us. Like most businesses our size, we do not write most of the software we depend on. We buy it, or we use services built by others. That means a good part of our security work is about asking suppliers the right questions and keeping a clear picture of who has access to what. We mention it here only because we think more businesses should talk about it plainly. If you supply a healthcare or logistics organisation, expect to be asked how you handle software security. That is not suspicion. It is the job.

Practical advice

If you run a small business or a charity, there is a lot of cyber advice around and most of it is too complicated to act on. Here is a short, realistic list. Start with Cyber Essentials rather than the ambassadors scheme. Cyber Essentials gives you five basic technical controls to put in place and a certification you can show customers. It is far more useful as a starting point than a voluntary code aimed at software producers. Write down which software and suppliers can reach your systems and your data. Most organisations have never made this list, and making it usually produces a surprise or two. Turn on automatic updates wherever you can, and make sure someone is responsible for the systems where you cannot. Remove access that is no longer needed. Old supplier accounts and former staff logins are a common route in. Ask suppliers direct questions before you sign. Do you follow the Software Security Code of Practice? How do you notify customers of a security incident, and how quickly? Who has access to our data? Use multi-factor authentication on email and anything financial. It is the single highest-value change most small organisations can make. And make a plan for the day something does go wrong, including how you would keep operating without your main system for a few days. The NCSC publishes free exercises and templates for exactly this.

What to know

DSIT published the group 2 signatories to the Software Security Ambassadors Scheme on 3 November 2026. The second group launched on 29 October 2026, and the scheme itself launched on 15 January 2026 under the Government Cyber Action Plan. The scheme promotes the Software Security Code of Practice, a voluntary set of principles aimed at reducing software supply chain attacks. DSIT says 59% of organisations experienced a software supply chain attack in the past year. Read that as evidence of a widespread problem rather than a precise count, since the definition is broad and detection varies by organisation size. Because the code is voluntary, its effect depends on buyers asking about it. For a small business, Cyber Essentials, an access list, automatic updates and multi-factor authentication will do more good, faster. Sources: Department for Science, Innovation and Technology, "Software Security Ambassadors Scheme", published 15 January 2026, last updated 3 November 2026, https://www.gov.uk/government/publications/software-security-ambassadors-scheme; Department for Science, Innovation and Technology, "Software Security Code of Practice", accessed 4 November 2026, https://www.gov.uk/government/publications/software-security-code-of-practice; National Cyber Security Centre, "Cyber Essentials", accessed 4 November 2026, https://www.ncsc.gov.uk/cyberessentials/overview This article is for general information and is not legal, financial or medical advice. For questions about your own health or medicines, speak to a doctor, pharmacist or other qualified healthcare professional.

#cyber security#software supply chain#DSIT#small business#digital resilience#code of practice

Related articles