Building trust and resilience through secure software practices
Key takeaways
- Sage used the UK Government’s Software Security Code of Practice to assess its established security, governance, and assurance practices across the Copilot Factory Framework (CFF).
- The assessment showed that embedding security throughout software design, development, deployment, and maintenance helps create more resilient AI-powered services.
- The assessment validated established security practices, including access reviews, third-party dependency controls, vulnerability management, and security documentation, while helping Sage make the supporting governance and evidence more explicit.
- Cross-functional collaboration between Security, Product, Engineering, Architecture, and Cloud Operations provided a more complete view of how security controls are understood and applied across the software lifecycle.
- Organisations can use the Software Security Code of Practice as a practical framework for continuous improvement, stronger customer assurance, and greater cyber resilience.
Digital services are central to how businesses manage finances, people, and operations. As reliance on software grows, and AI capabilities become embedded across more products, users need confidence that security is built into how the technology is designed, developed, and maintained.
At Sage, maintaining software security is part of our wider commitment to building trust and resilience.
As signatories of the UK Government’s Cyber Resilience Pledge and ambassadors of the Software Security Code of Practice, we’re committed to finding practical ways to test our security approach, learn from the process, and help promote stronger security across the wider software ecosystem, while encouraging our partners to do the same.
Here’s what we talk about in this article:
Why Sage supports the Cyber Resilience Pledge
Cyber resilience is not only a technical priority. It is essential to business continuity, customer confidence, and responsible innovation. By supporting the Pledge and the Code, Sage is reinforcing its commitment to secure software practices and collaboration between government and industry. This collaboration helps translate shared security principles into practical action: government provides a clear and consistent framework, while industry applies it in real operating environments and shares practical insights to support its continued relevance and wider adoption.
Our involvement with the Code reflects our broader responsibility to contribute beyond our own organisation. By sharing practical experience, Sage can help other organisations understand how the Code can be applied, encourage partners to adopt stronger practices and provide constructive industry insight into how voluntary frameworks work in practice. This helps build a more consistent approach to software security across the wider ecosystem and keep the focus on sustained resilience rather than one-off compliance.
The approach
Sage selected the Copilot Factory Framework (CFF) for assessment against the Software Security Code of Practice as it provides AI capabilities that can be used across multiple products. This made it a meaningful test of whether established security practices could be demonstrated consistently in a shared, fast-evolving technology environment.
The CFF provides a scalable foundation for delivering AI-powered experiences across Sage products, enabling teams to build and deploy AI capabilities using consistent governance, security controls, and approved technologies. Assessing a shared platform therefore offered value beyond a single service: it tested the foundations that product teams rely on when bringing AI capabilities to customers.
The assessment was not simply about confirming alignment with individual controls. It examined how security decisions, evidence, and responsibilities connect across the full lifecycle and whether that approach could provide clear assurance to the teams that depend on the CFF.
The assessment brought together colleagues from Security, Product, Engineering, Architecture and Cloud Operations.
A dedicated security lead coordinated the collection and validation of evidence, and an independent third party, NCC Group, reviewed the evidence against the Code’s controls.
The independent review confirmed established strengths and created a clear route for further improvement. In particular, it showed where greater clarity, formality, and consistency would make existing governance easier to apply, evidence, and understand across teams.
Key outcomes and lessons learned
Embedding security throughout design and development
The review reinforced the importance of building security into design and development decisions for the CFF. This includes the consistent governance of third-party services, software components, dependencies, and licences from the outset, supported by clear and accessible evidence. Embedding these practices early strengthens traceability, supports compliance, and helps product teams identify and address software security risks before delivery.
Validating assurance around the build environment
The review validated the controls that protect the integrity and security of the software build environment, including managed access, strong authentication, infrastructure-as-code, and audit logging. It also identified an opportunity to introduce greater formality and consistency through repeatable access reviews, providing ongoing assurance that access remains appropriate and aligned with business need.
Validating secure deployment and maintenance
The review considered how vulnerabilities are identified, prioritised, and managed throughout the software lifecycle. It validated the effectiveness of existing vulnerability management practices against the Software Security Code of Practice, including automated security scanning, penetration testing, and defined remediation targets. The outcome was stronger assurance that risks are addressed according to their significance and managed consistently throughout the lifecycle. For teams using the CFF, this provides greater confidence that vulnerabilities affecting a shared platform can be identified and acted on in a structured and timely way.
Clarifying service commitments
Because the CFF primarily provides AI services to other Sage products, some of the Code’s requirements needed to be considered in the context of internal product customers.
The review validated the service governance supporting the CFF, including established support and communication processes, lifecycle management, and commitments around service retirement. It also identified opportunities to express these practices with greater clarity and formality. This provides dependent teams with greater transparency and predictability, reduces operational risk, enables more effective planning, and supports reliable service delivery across the organisation.
Advice and insights for other organisations
For organisations considering using the Code, our experience highlighted four practical ways to gain greater value from the assessment:
- Use the Code as a catalyst for improvement. The greatest value can come from the conversations the assessment creates and the opportunities it reveals. Clearly expressed governance and ownership can deliver greater clarity, accountability, and assurance.
- Formalise what already works. Strong practices may already exist, but clear ownership, documented commitments and accessible evidence make it easier to demonstrate that controls are operating as intended.
- Bring the right people together early. Software security spans more than one function. Involving Security, Product, Engineering, Architecture, and Cloud Operations creates a more complete view of how security is applied across the lifecycle.
- Share practical learning. Implementation experience can help other organisations apply the Code, support wider adoption, and strengthen resilience across the software ecosystem.
Final thoughts: Future commitments
The Software Security Code of Practice offers organisations a valuable opportunity to strengthen security, build customer trust, and demonstrate responsible leadership.
For organisations considering the Code, the first step is to assess how its principles align with existing practices, identify where ownership or evidence could be strengthened, and involve the right teams early. The wider opportunity is to use the assessment not only to improve internal assurance, but also to contribute practical insight that helps raise standards across the industry.
Sage continues to advocate for the Code beyond our own assessment by sharing practical expertise and encouraging participation across our partner ecosystem. This extends the value of government-industry collaboration: lessons learned from implementation can support wider adoption, strengthen collective resilience and demonstrate how common principles can be applied in different operating environments. Zynk’s adoption of the Department for Science, Innovation and Technology’s Software Security Code of Practice shows how shared learning and advocacy can help extend common security principles through the wider partner ecosystem.
Browse more topics from this article
PakarPBN
A Private Blog Network (PBN) is a collection of websites that are controlled by a single individual or organization and used primarily to build backlinks to a “money site” in order to influence its ranking in search engines such as Google. The core idea behind a PBN is based on the importance of backlinks in Google’s ranking algorithm. Since Google views backlinks as signals of authority and trust, some website owners attempt to artificially create these signals through a controlled network of sites.
In a typical PBN setup, the owner acquires expired or aged domains that already have existing authority, backlinks, and history. These domains are rebuilt with new content and hosted separately, often using different IP addresses, hosting providers, themes, and ownership details to make them appear unrelated. Within the content published on these sites, links are strategically placed that point to the main website the owner wants to rank higher. By doing this, the owner attempts to pass link equity (also known as “link juice”) from the PBN sites to the target website.
The purpose of a PBN is to give the impression that the target website is naturally earning links from multiple independent sources. If done effectively, this can temporarily improve keyword rankings, increase organic visibility, and drive more traffic from search results.
Streaming Film
Nonton Film gratis
Jasa Backlink
Download Anime Batch









