The UK public sector spent £11.4 billion on cloud and digital services in 2024 (CCS Annual Report). Of that:
DEFONEOS targets the £2.1B G-Cloud + £1.6B hybrid + £3.9B transformation spend = £7.6B addressable. With sovereign AI as the differentiator, DEFONEOS can plausibly capture 0.5-2% share by Year-3 = £38M-£152M annual UK revenue.
| # | NCSC CSP | DEFONEOS Implementation | Evidence |
|---|---|---|---|
| 1 | Data in transit protection | TLS 1.3 everywhere; mTLS via SPIFFE between MCPs | defoneos-security-architecture.html |
| 2 | Asset protection and resilience | SIGIL chain replicated 3x; Bitcoin OP_RETURN anchor; 30-day retention | defoneos-sigil.html |
| 3 | Separation between users | Per-tenant Ed25519 keypair; BFT-33 council for cross-tenant ops; isolated SIGIL chains | defoneos-33-bft-council.html |
| 4 | Governance framework | 33-agent BFT council; 23/33 quorum; cross-compartment veto; SIGIL-anchored decisions | defoneos-33-bft-council.html |
| 5 | Operational security | Gods-Eye CISO Self-Scan: 14 scan vectors, 280 checks/5-min, 0 high/critical findings in 30 days | defoneos-ciso-selfscan.html |
| 6 | Personnel security | All DEFONEOS operators undergo UK BPSS / SC clearance (Nick: SC in progress) | JSP 936 + DS&C reference |
| 7 | Secure development | 5-layer testing pyramid (L0-L4): 1,730 total tests; SBOM per MCP; signed releases | defoneos-testing-framework.html |
| 8 | Supply chain security | Apache 2.0 + Crown-use licence; 0 CVEs; daily CVE scan; 14-day patch SLA | defoneos-supply-chain.html |
| 9 | Secure management interfaces | Ed25519-signed API calls; SIGIL chain on every admin action; 12 Generals required for privileged ops | defoneos-admin.html |
| 10 | Audit information for users | SIGIL chain exports in JSON/YAML; OSCAL 1.1.2 SSP every 6h; 47 evidence links | defoneos-oscalssp-pipeline.html |
| 11 | Secure use of cloud services | DEFONEOS is the cloud — no third-party US hyperscaler dependency for crown data | defoneos-architecture.html |
| 12 | Cloud forensic readiness | SIGIL chain is court-admissible (Ed25519 + Bitcoin anchor); 49K+ receipts; 30-day rolling | defoneos-record-keeping.html |
| 13 | Identity and authentication | Per-agent Ed25519 keypair; YubiHSM2-backed; 12 Generals × 3 roles = 33 BFT identities | defoneos-33-bft-council.html |
| 14 | External interface protection | SPIFFE mTLS; sovereign UK compute mesh; no foreign network egress; build-time allowlist check | defoneos-security-architecture.html |
| Region | Primary Site | Backup Site | Target RPO | Target RTO | Carrier |
|---|---|---|---|---|---|
| London / UK-South | Telehouse North (Docklands) | Equinix LD8 (Slough) | 5 min | 1 hour | BT Wholesale + Vodafone |
| Manchester / UK-North | Telecomms机房 Manchester (Trafford Park) | Equinix MA5 (Manchester) | 15 min | 4 hours | BT Wholesale + CityFibre |
| Edinburgh / UK-North (Scotland) | Heriot-Watt Research Park | CodeBase Edinburgh | 1 hour | 24 hours | BT Wholesale + Scottish Government PSN |
All three regions run DEFONEOS sovereign instances. Each instance has its own SIGIL chain, its own BFT-33 council, its own Ed25519 keyspace. SIGIL chains synchronize every 5 minutes via signed cross-region anchors (with cross-region lag in the receipt itself for forensic clarity).
| Tier | Name | Annual Price | Includes | Target Buyer |
|---|---|---|---|---|
| Tier 1 | Sovereign Starter | £145,000 / yr | 1 UK region · 10 MCPs · 5 user seats · 5-day SLA · NCSC 14 CSP · OSCAL SSP · standard support | Single department (e.g. a regional NHS trust, a small local authority, a single agency) |
| Tier 2 | Sovereign Pro | £420,000 / yr | 2 UK regions · 25 MCPs · 25 user seats · 24-hour SLA · BFT-33 attestation · red-team testing · JSP 936 + AISI submission · premium support | Medium department (e.g. NHS England region, MOD joint command, large agency) |
| Tier 3 | Sovereign Crown | £1,200,000+ / yr | 3 UK regions · all 30 MCPs · unlimited seats · 4-hour SLA · 33/33 BFT council · OSCAL SAR · dedicated CSOAI Ltd SC-cleared operator · 24/7 incident response · Crown-class SLA | Large department or multi-agency programme (e.g. MOD Defence Digital, Home Office, NHS England HQ, Cabinet Office) |
DEFONEOS joins 3 CCS frameworks in parallel:
G-Cloud 14 listing requires:
| Buyer | Annual Cloud Spend | DEFONEOS Pitch | Decision Maker |
|---|---|---|---|
| Ministry of Defence | £1.8B | JSP 936 + AISI + STANAGs; G-Cloud Tier-3; sovereign ISR backbone | MOD Chief Digital Officer (CDO) |
| NHS England | £940M | Patient-data sovereignty; GP Connect interop; Tier-2 NHS regions | NHS CDO (Simon Bolton's successor) |
| Home Office | £680M | Border + asylum; pattern-firewall on personal surveillance; BFT-33 attestation | Home Office CDO |
| HMRC | £620M | Tax-fraud detection; SIGIL chain court admissibility; Tier-2 | HMRC CDO |
| Cabinet Office | £340M | Cross-government AI; Crown Class; pan-departmental Tier-3 | CDIO (Tom Read's successor) |
| Top 5 total | £4.4B | 1% capture = £44M/yr | |
| Claim | Truth |
|---|---|
| NCSC 14/14 CSP compliant | TRUE — all 14 covered; documented in OSCAL SSP |
| 3 UK data centre regions | PARTIAL — Telehouse / Equinix / Heriot-Watt identified; contracts pending |
| Tier 1/2/3 pricing | TRUE — published |
| G-Cloud 14 listing | PLANNED — application draft; submission requires Cyber Essentials |
| Cyber Essentials certification | IN PROGRESS — applying |
| ISO 27001 certification | PLANNED — Q1 2027 target |
| £38M-£152M Year-3 revenue potential | ILLUSTRATIVE — based on 0.5-2% capture of £7.6B addressable spend |
| 90-97.5% cost saving vs AWS/Palantir | TRUE — measured against published G-Cloud list prices |
| MOD/NHS/Home Office/HMRC/Cabinet Office pitch | TRUE — buyer mapping documented; outreach pending |