Ten 'secure' tools can still make one insecure stack. Dragonfly and UCL just won Innovate UK funding to fix that.
18 months, $1m, and one goal: turning the UK's Software Security Code of Practice into something businesses can actually use
Ten "secure" tools can still make one insecure stack. We've just been backed to fix that.
Today we get to share some news we've been sitting on for a while. Dragonfly, in partnership with UCL School of Management, has been awarded £704,863 (approximately $1 million) in funding from Innovate UK, part of UK Research and Innovation (UKRI), through the Secure Software for Resilient Growth competition. The 18-month project starts this month, and it takes aim at one of the hardest problems in technology decision making: how do you know whether the software running your business can actually be trusted, together, as a whole?
Download the full PDF resource
Enter your email address below to unlock the downloadable PDF version of this resource.
Thank you! Click below to download your PDF.
Download PDFThe question that kept coming up
When we started Dragonfly in December 2024, the bet was simple. Choosing software is broken, and the businesses living with the consequences of those decisions deserve independent, honest answers they can act on. So we built a knowledge graph of more than 300,000 software vendors and launched publicly last October, backed by a £2.6M pre-seed led by Episode 1 alongside Portfolio Ventures and Dreamcraft.
Since then we've spoken with hundreds of businesses about their stacks, and almost every serious conversation lands on the same question of trust. That question goes far beyond any single vendor. Leaders want to know whether the tools they've chosen can safely and effectively work together, especially now that AI systems and autonomous agents are being wired into stacks faster than anyone can evaluate them.
The uncomfortable truth is that existing security tools can't answer that question. They assess vendors one at a time, but real-world risk lives in the connections between tools. The data flows, the integrations, the shadow IT, the over-privileged connectors that quietly link everything together. A business can select ten individually "secure" products and still end up with a dangerously insecure whole.
That's not a theoretical problem. Cyber attacks cost the UK economy an estimated £14.7 billion a year, roughly 0.5% of GDP, and fragmented, poorly secured software infrastructure is among the weaknesses attackers exploit most.
We're entering a world where every business will have both human and AI colleagues working together. The technology decisions organisations make over the next decade will fundamentally shape their ability to innovate, compete and adopt AI safely.
Sean King, co-founder at Dragonfly and project lead
A standard exists. Almost nobody can use it.
In January 2025, the UK Government published the Software Security Code of Practice (SSCoP): 14 principles that set a baseline for software security across supply chains. It's a genuinely useful piece of work. It's also, for most businesses, a document rather than a tool. Very few organisations have the expertise to check whether their stack meets the standard, or to make security-informed decisions when choosing what to buy next.
That gap, between a published standard and a business's ability to actually apply it, is exactly the kind of problem Dragonfly exists to close.
What we're building with UCL
Over the next 18 months, we'll build a secure stack advisory layer on top of Dragonfly's knowledge graph. Concretely, that means:
- Encoding all 14 SSCoP principles as machine-queryable attributes, cross-mapped to the standards businesses are already accountable to: ISO 27001, NIS2 and the EU Cyber Resilience Act.
- A compositional risk engine that evaluates complete multi-vendor stacks rather than individual tools: tracing data flows across tool boundaries, detecting weakest links and shadow IT exposure.
- Plain-language, citation-backed recommendations that a non-technical decision maker can read, trust and act on.
The result is the world's first machine-queryable trust layer for software. Ask it whether your stack meets the SSCoP baseline and you get an answer with evidence behind it, in seconds. And because it's machine-queryable, it's not only humans who can ask. As businesses hand more decisions to AI agents, those agents need a trustworthy source to check against before they act. We're building the layer they'll check.
%20.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
Why UCL
Evaluating a technology stack is a brutally hard combinatorial problem. Hundreds of tools, each with its own security posture, assessed against interoperability, regulatory and security constraints that all interact with each other. This is decision-making under uncertainty at serious scale, and it's precisely the territory of our partners at UCL School of Management.
The research will be led at UCL by Professor Onesun Steve Yoo as Principal Investigator, alongside co-investigators Dr Yi-Chun Akchen, Dr Yuri Resende Fonseca and Dr Aras Selvi. Between them, the team brings deep expertise in optimisation, machine learning and decision-making under uncertainty. Pairing that rigour with the real-world data in our knowledge graph, and the real-world questions our customers ask every day, is what makes this project possible at all.
What this means for Dragonfly
We're entering a world where every business will have both human and AI colleagues working side by side. The technology decisions organisations make over the next decade will shape their ability to innovate, compete and adopt AI safely. Our vision has always been to build the world's most trusted intelligence layer for those decisions, and this project moves trust from something we describe to something you can query.
The support from Innovate UK is a serious validation of both the problem and the opportunity, and it means this research happens here in the UK, contributing to the UK's leadership position in secure software and AI innovation.
A huge thank you to the team at Innovate UK, and to Steve, Yi-Chun, Yuri and Aras at UCL. We can't wait to get started. Well, technically, we already have.
You can read the full press release here, and if you'd like to see what Dragonfly can already tell you about your stack, visit askdragonfly.com.
As businesses increasingly rely on complex ecosystems of software and AI systems, there is a growing need for trustworthy and explainable approaches to technology decision making. This collaboration brings together cutting-edge academic research with real-world industry challenges to develop practical solutions that can help organisations navigate complexity with greater confidence. We're excited by the opportunity to contribute both rigorous research and meaningful impact through this partnership.
Explore more resources
News
Dragonfly raises £2.6 million pre-seed to help businesses get ahead with smarter decisions about software
Dragonfly, the world’s most powerful software discovery platform, today announced the close of a £2.6M pre-seed round alongside the public launch of its conversational AI tool. Founded in December 2024 by Zego alumni Sean King and Sven Sabas, the round was led by Episode 1, joined by Dreamcraft and Portfolio Ventures, with angels including QuantumBlack founder and CTO Sam Bourton, and Bolt founder and CEO Markus Villig.
Sean King & Sven Sabas
February 14, 2026
0
min read
Dragonfly raises £2.6 million pre-seed to help businesses get ahead with smarter decisions about software
The number of software tools has exploded in recent years. Tech users no longer find themselves facing a decision between an incumbent provider and a challenger; today, there may be hundreds of options to consider for any given job. The rise of AI and vibe-coding has rapidly accelerated the development of new applications, but substantially increased the time needed to evaluate the security, reliability and interoperability of different technologies. Expert advice on business architecture - from systems architects or management consultants - is inaccessible to the majority due to high costs, and the pace of innovation makes it impossible for anyone to stay up-to-date.
Dragonfly aims to make the expertise of a solutions architect instantly accessible to everyone, from individual professionals to enterprise leaders. The startup has compiled the world’s largest catalogue of software tools and their capabilities, currently standing at over 250,000 products, from a range of trusted data sources. This dataset feeds into a variety of AI-powered features, which will help users find the right tech stacks in seconds, rather than months.
Today, Dragonfly has made its proprietary conversational AI tool available to the public. Instead of scrolling through marketplaces filled with outdated and incomplete information, or sitting through lengthy sales demos, users will be able to ask Dragonfly questions; within seconds, Dragonfly will recommend a list of suitable products, ranked by relevance, with supporting explanations.
The tool is designed to cater for simple queries in plain language, such as "what’s the best project management software for a team of five that integrates with Google Calendar and has a free plan," and more complex prompts, for example "we need to build a secure, compliant technology architecture to support a new financial services product for our European customers; we need recommendations for tools that can handle real-time data ingestion, are GDPR-compliant, and integrate with our existing AWS infrastructure, and we'd also like to see how these tools would work together in a single blueprint.
From late 2025, Dragonfly is set to roll out its enterprise offering to help organisations build, manage and evolve their tech stacks. Businesses will be able to map out their software with the aid of Dragonfly’s ‘digital fingerprinting’ technology, which captures a blueprint of their business system architecture. With this detailed context, Dragonfly will supply insights and software recommendations tailored to each company’s environment, goals and growth stage.
King and Sabas have assembled a team of 12 with several former colleagues from Zego, Peppy and Permutive joining the founders in their new venture. The pre-seed funds will be used to develop a range of new features in support of the startup’s mission to build a comprehensive ‘Automated Solutions Architect’, further enrich Dragonfly’s data, and recruit select new hires as needed.
Hector Mason, General Partner at Episode 1, said: "Before Dragonfly, it was almost impossible to gather enough context about software tools to truly understand their capabilities, and whether they fit seamlessly within an existing stack. By solving this critical problem, made even more urgent with the rapid adoption of AI, Dragonfly has the potential to make every company on the planet operate more effectively.
Sam Bourton, co-founder and CTO at QuantumBlack, said: “I first met Sean and Sven after having spent three days with 150 CIOs and CTOs, witnessing firsthand the mounting complexity of the modern tech and data landscape. The explosion of GenAI and agentic systems has amplified the problem - leaders face a firehose of requests for new AI tools, with a thousand flowers blooming across their organisations, each demanding attention and resources. Taking stock of their existing tech stack, evaluating options, and managing security, dependencies, and integrations has never been harder.
To try Dragonfly for free, visit www.askdragonfly.com or see our social media channels for latest updates.
