The strategic imperative of openness: securing the defence supply chain
Guest blog by Dean Clark, Architect, EMEA Defence Strategy; Nick Maynard, Principal Technologist, UK Defence and Jonny Williams, Chief Digital Adviser, UK Public Sector at RedHat #techUKSupplyChainSecurityWeek
Dean Clark
Architect, EMEA Defence Strategy, Red Hat
Dean Clark
Architect, EMEA Defence Strategy, Red Hat
Nick Maynard
Principal Technologist, UK Defence, Red Hat
Nick Maynard
Principal Technologist, UK Defence, Red Hat
Jonny Williams
Chief Digital Adviser, UK Public Sector, Red Hat
Jonny Williams
Chief Digital Adviser, UK Public Sector, Red Hat
The landscape of National Security is undergoing a fundamental shift. For decades, the Defence community relied on the concept of the "walled garden." We built proprietary systems, often disconnected from the wider world, under the assumption that isolation and obscurity were our best defences. But in an era of software-defined warfare and interconnected logistics, those walls have now become glass.
As we take in techUK’s Supply Chain Security Campaign week, it is time to have a candid conversation about the nature of trust across our digital foundations. Leading technical strategy within the Defence sector at Red Hat, we see that threats to our resilience go beyond the adversary to a lack of understanding of the tools we use to defend against them: where they come from, who created them, and what they can do. To secure the UK’s next generation of land, air, and sea platforms, we must move away from the “black box” and truly embrace the “open source way”.
The myth of proprietary security
For too long, both industry and customers believed that proprietary software was inherently more secure due to its “hidden by default” nature. In reality, this creates a single point of failure. If a vulnerability exists in a closed-system component, you must implicitly trust the vendor to identify, acknowledge, and fix it. In a Defence context, waiting for a patch that may or may not be coming while a platform is deployed should be an unacceptable risk.
Open source completely flips this paradigm on its head. Operating on the principle of Linus’s Law: “given enough eyeballs, all bugs are shallow”. When we build on open source foundations, we are leveraging a global immune system. Thousands of developers, including those from Red Hat and other industry leaders, are constantly auditing the code, finding vulnerabilities, and contributing fixes. For the Ministry of Defence and its tier 1 suppliers, this means the ability to verify security for ourselves, rather than relying on a vendor’s “trust me” assurance.
Operationalising trust through standards
A secure supply chain is not a static product, instead it is a rigorous, verifiable process. This is where open standards become the DNA of our protection.
Consider the Software Bill of Materials, or SBOM. In the physical world, every component of a Type 45 destroyer is tracked: from the turbine to the smallest bolt. We know where it was forged and what it is made of. Until recently, we did not have that same level of granularity for software. A single application might contain hundreds of sub-components and libraries, many of them open source, pulled from various repositories.
By adopting open standards like SBOM and the SLSA (Supply-chain levels for Software Artifacts) framework, we can move from “blind trust” to “verifiable trust”. We can now automatically scan our entire digital inventory to see if a newly discovered vulnerability, (Log4j as an example) exists within our environments. This isn’t just a technical “nice-to-have”, it is a sovereign requirement. It allows the UK to maintain control over its own digital destiny.
Red Hat == Upstream first
At Red Hat, we live by a principle called “Upstream first”. This means that every time we find a bug or create a security enhancement, we contribute it back to the original open-source project before we include this in our enterprise products.
From a Defence perspective, this is a strategic force multiplier. It ensures that the entire ecosystem becomes more resilient. If we harden the Linux Kernel for a specific high-security Defence use case, those improvements benefit the wider community, which in turn continues to build upon and test those very same features. This creates a virtuous cycle of continuous improvement that no proprietary vendor can match.
Additionally, this approach tackles the problem of legacy and obsolescence. Proprietary systems often die when the company that made them loses interest or goes out of business, creating a fixed point of vulnerability that must be mitigated. Open-source projects, supported by a diverse community and open standards, ensure that our long-lived Defence platforms can be maintained and secured for decades, not just until the next contract cycle.
Shadow AI and the risk of the unknown
The techUK campaign rightly highlights the risks of “Shadow AI”. We are seeing an explosion of the Large Language Models used by employees to solve problems quickly. In a Defence environment, the use of unapproved, “black box” AI models is a significant supply chain risk. How do we know what data the model was trained on? How do we know if the model’s output or Inference has been subtly compromised?
The answer, again, lies in openness and transparency. By pushing for Open Source AI. we allow the same level of scrutiny we apply to traditional software. We can audit the training data, the model weights, and the algorithms. This transparency is the only way to safely integrate AI into our land, air, and sea platform without compromising our national security posture.
A shared responsibility
Securing the supply chain is not something the MoD can do alone, nor is it something a single vendor can solve. It requires a collaborative fabric where government, industry and the open-source community work in tandem.
This brings us to the core of Red Hat’s opinionated stance that Security is a team sport. By using open-source practices, we are not just sharing code, we are sharing risk intelligence and best practices. We are building a “Digital Commons” that is more resilient than individual siloes of self-interest.
As we participate in TechUK’s campaign week, our message to the Defence community is this: do not be afraid of the transparency that open-source brings. It is not a vulnerability, it is our greatest strength. It allows us to build systems that are secure by design, verifiable by anyone, and resilient enough to withstand the evolving threats of the 21st century.
We must demand SBOMs from every provider. We must contribute back to the upstream projects that underpin our critical infrastructure. And we must move toward a future where our digital supply chains are as visible and hardened as the physical hardware they control.
The “Open Source Way” is more than just a development methodology. For the UK’s National Security, it is the only way forward. By embracing openness, we ensure that our platforms remain autonomous, our data remains sovereign, and our defences remain strong. Use this campaign week to commit to a more transparent, collaborative and ultimately more secure future for the British Defence supply chain.
techUK Supply Chain Security Campaign Week 2026
Explore the technologies, policies and partnerships shaping the future of secure and resilient supply chains across the UK. From third-party cyber risk to defence, AI and operational resilience, Supply Chain Security Campaign Week brings together expert insight on the challenges organisations are facing and how industry is responding. Follow the week to stay informed and connected to the evolving threat landscape.
Securing the chain: innovation, accountability and resilience in supply chain security webinar
Explore how organisations are strengthening supply chain security through innovation, accountability and resilience. Gain insight into emerging technologies, regulatory approaches and practical strategies for managing cyber risk across complex supply chains. Join the webinar to understand how industry and government are responding to an evolving threat landscape.
techUK brings together key players across the cyber security sector to promote leading-edge UK capabilities, build networks and grow the sector. techUK members have the opportunity to network, share ideas and collaborate, enabling the industry as a whole to address common challenges and opportunities together. Visit the programme page here.
Supply Chain Security in Practice – Real-world strategies from techUK members
Discover practical strategies for strengthening supply chain security through real-world examples from techUK members. Explore how organisations are managing cyber risk, improving resilience and responding to evolving operational and regulatory challenges. Read the playbook to gain actionable insight and learn from approaches already being applied across industry.
Explore the key challenges and opportunities shaping secure and resilient supply chains through techUK’s Supply Chain Security Campaign Week 2026. Gain insight into cyber risk, defence, AI, resilience and public-private collaboration from across industry and government. Follow the campaign to access expert perspectives and practical approaches to strengthening supply chain security.
Our members develop strong networks, build meaningful partnerships and grow their businesses as we all work together to create a thriving environment where industry, government and stakeholders come together to realise the positive outcomes tech can deliver.
Jill leads the techUK Cyber Resilience programme, having originally joined techUK in October 2020 as a Programme Manager for the Cyber and Central Government programmes. She is responsible for managing techUK's work across the cyber security ecosystem, bringing industry together with key stakeholders across the public and private sectors. Jill also provides the industry secretariat for the Cyber Growth Partnership, the industry and government conduit for supporting the growth of the sector. A key focus of her work is to strengthen the public–private partnership across cyber to support further development of UK cyber security and resilience policy.
Before joining techUK, Jill worked as a Senior Caseworker for an MP, advocating for local communities, businesses and individuals, so she is particularly committed to techUK’s vision of harnessing the power of technology to improve people’s lives. Jill is also an experienced editorial professional and has delivered copyediting and writing services for public-body and SME clients as well as publishers.
Annie is the Programme Manager for Cyber Resilience at techUK. She first joined as the Programme Manager for Cyber Security and Central Government in September 2023.
In her role, Annie supports the Cyber Security SME Forum, engaging regularly with key government and industry stakeholders to advance the growth and development of SMEs in the cyber sector. Annie also coordinates events, engages with policy makers and represents techUK at a number of cyber security events.
Before joining techUK, Annie was an Account Manager at a specialist healthcare agency, where she provided public affairs support to a wide range of medical technology clients. She also gained experience as an intern in both an MP’s constituency office and with the Association of Independent Professionals and the Self-Employed. Annie holds a degree in International Relations from Nottingham Trent University.
Olivia Staples joined techUK in May 2025 as a Junior Programme Manager in the Cyber Resilience team.
She supports the programs mission to promote cyber resilience by engaging key commercial and government stakeholders to shape the cyber resilience policy towards increased security and industry growth. Olivia assists in member engagement, event facilitation and communications support.
Before joining techUK, Olivia gained experience in research, advocacy, and strategic communications across several international organisations. At the Munich Security Conference, she supported stakeholder engagement and contributed to strategic communications. She also worked closely with local and national government stakeholders in Spain and Italy, where she was involved in policy monitoring and advocacy for both public and private sector clients.
Olivia holds an MSc in Political Science (Comparative Politics and Conflict Studies) from the London School of Economics (LSE) and a BA in Spanish and Latin American Studies from University College London (UCL).
Outside of tech, Olivia enjoys volunteering with local charities and learning Norwegian.
