Velinor
Velinor is a UK-based cleared delivery partner that embeds experienced, security-cleared cyber specialists into defence and government programmes for primes, integrators, and consultancies. The company also provides cyber and AI assurance services, including exposure assessments, evidence-pack creation, and a free twelve-question checklist to help suppliers determine their required Defence Cyber Certification level under Def Stan 05-138 Issue 4.
- Cybersecurity
- Regulatory & Compliance Technology
- Defense Tech
- Artificial Intelligence
- Government Technology
- Data & Analytics
- Software Only
Funding
Founders
Founder details are not available yet.
Product
Problem
Most organisations cannot accurately state what of their digital estate is exposed to the internet at any given time, nor can they produce evidence that their AI systems would withstand an audit or regulatory review. This becomes critical for defence suppliers facing the 31 December 2026 deadline under Industry Security Notice 2025/07, which mandates compliance with Cyber Security Model v4 and Def Stan 05-138 Issue 4 for all MOD contracts carrying DEFCON 658. The gap between certification levels is substantial, with Level 0 requiring only three controls while Level 1 demands 101.
Solution
Velinor provides cyber and AI assurance services that help organisations identify what is actually at risk, prove it is managed, and keep the evidence current. The company assesses internet-facing exposure and AI use cases against real-world threat, producing a ranked risk register and an evidence pack that stands up to boards, regulators, assessors, or insurers. Velinor's methodology is grounded in the AI Blindspot Framework, a risk taxonomy calibrated against documented real-world AI failures drawn from public sources such as regulator decisions, court rulings and established media. Beyond its own services, Velinor places experienced, security-cleared personnel into defence and government programmes for primes, integrators and consultancies, holding the subcontract and delivering against scoped work packages. The firm also offers a free, no-sign-up twelve-question checklist that helps suppliers determine which Defence Cyber Certification level their contracts require, distinguishing between the three controls at Level 0 and the 101 controls at Level 1.
Target Audience
Primary customers are defence suppliers, government contractors, and organisations in critical national infrastructure and regulated industries that must meet MoD cyber certification requirements or prove AI assurance to auditors and regulators. The company also serves primes, integrators and consultancies that need cleared cyber specialists embedded in their delivery programmes.
Features
- Exposure assessment that identifies internet-facing assets and ranks them against real-world threat
- AI assurance using the AI Blindspot Framework, a risk taxonomy built from documented AI failures in public OSINT sources such as regulator decisions, court rulings and established media
- Evidence-pack creation designed to satisfy assessors, primes, regulators, and insurers
- Free, no-sign-up DCC checklist covering twelve questions to determine required certification level, including whether the DEFCON 658 clause exists in signed contracts and when the contract anniversary falls
- Alignment with Def Stan 05-138 Issue 4 controls, including vulnerability management, patching policy, asset inventory, and security monitoring
- Continuous evidence maintenance to keep records current as the estate and rules evolve
- Cleared delivery partner model providing named, security-cleared personnel (including former British Army intelligence analysts and Royal Signals veterans) to primes on defence and government programmes
- Cyber Essentials (Basic) certification held by the company itself, demonstrating its own security posture