Secure by Design makes security part of the product’s DNA, not a bolt-on. At QinetiQ, this is how we do cyber-in-engineering: security embedded into architecture, trade-offs and verification from day one. Step by step, we show how theory becomes practice and what those responsible for defence, critical national infrastructure and high-stakes commercial systems can take from it.
Positioning, Navigation and Timing (PNT) underpins finance, telecoms, logistics, energy networks and defence. Global Navigation Satellite System (GNSS) constellations such as GPS, Galileo, GLONASS and Beidou have made PNT ubiquitous and inexpensive but have also created widespread dependency and vulnerability to jamming, spoofing and wider RF and cyber disruption. The UK Government estimates an outage would cost more than £1 billion per day. For both defence and critical national infrastructure (CNI), the stakes are higher still.
We don’t treat security as a parallel track. We embed cyber into the same requirements, design, assurance and supply-chain decisions as performance and SWaP-C. That cyber-in-engineering approach is what enables us to meet the Secure by Design expectations of the UK Ministry of Defence (MoD) and His Majesty’s Government (HMG) as a matter of course.
QinetiQ’s Q40 GNSS receiver was originally developed under the UK’s Resilient Global Navigation System (RGNS) programme to meet government requirements for assured, secure PNT. Those same needs resilience to jamming and spoofing, compact form factor, ease of integration and freedom from US ITAR constraints are shared across critical national infrastructure and high-stakes commercial domains. Q40 now provides a sovereign, assured receiver that serves defence, CNI and other mission-critical users alike.
Andrew Evans, QinetiQ Security Engineering:
“PNT isn’t just a convenience — it’s a backbone service. When it fails, the costs are immediate and the risks are strategic.”
Secure by Design (SbD) is not a checklist. In MoD/HMG terms, it is an outcome of a threat-led, through-life approach. In our work, SbD is delivered in cyber-in-engineering — making security part of normal engineering from inception.
In practice, that means:
Evans:“For us, Secure by Design means embedding security into the engineering process from the start — making it part of the product’s DNA, not a bolt-on.”
Two shifts shaped Q40’s delivery:
Treating cyber as an engineering concern (not a parallel process) made adjusting to these shifts natural: the delivery team already owned the engineering risk; they also owned the security risk.
A joint Security Working Group (SWG) with MOD reviewed the design at key points, so confidence was built progressively rather than sought at the end.
The following steps show cyber-in-engineering in practice on the Q40. They map directly to MoD and HMG Secure by Design principles; they are not a new set of principles but the practical actions we took to implement them in development and delivery.
QinetiQ started with a clear view of where and how Q40 would be used and what adversaries would try to do across its life. Protection focused on what matters most (signal integrity, jamming/spoofing resilience) within strict size, weight, power and cost bounds.
Evans:“For us, Secure by Design means embedding security into the engineering process from the start — making it part of the product’s DNA, not a bolt-on.”
Security was embedded in the same requirements set used by all engineering teams. This made it traceable, tradeable and part of the normal change-control process. Like performance or cost, security could be balanced, tracked into the design and verified, rather than treated as a bolt-on.
Evans:“If it’s in the system requirements from day one, it’s part of the trade-off — not a nasty surprise.”
Security was embedded in the same requirements set used by all engineering teams. This made it traceable, tradeable and part of the normal change-control process. Like performance or cost, security could be balanced, tracked into the design and verified, rather than treated as a bolt-on.
Evans:“We didn’t have an isolated ‘security lane’ — we ran security in the same lane as the rest of engineering.”
The microchip was custom-fabbed in Europe following a foundry study that considered certification, location and ownership; a key UK SME was uplifted with penetration testing and hardening. Need-to-know was applied across suppliers; incoming software components were controlled for provenance and monitored for publicly disclosed vulnerabilities. This is cyber-in-engineering at supply-chain level: recognising criticality, uplifting where appropriate and adding controls where limits exist.
This approach also works in CNI sectors, where high-assurance component sourcing and supplier uplift can reduce operational risk and regulatory exposure.
Evans:“We treated suppliers like parts of the system — some needed strengthening, all needed boundaries.”
Security was applied proportionally to threat and impact, not everywhere at maximum level.
Evans:“The aim was a sweet spot: secure enough to beat the threat, light enough to fit the mission.”
Evans:“When MoD watch the whole film, they don’t need a snapshot at the end."
QinetiQ planned for:
Evans:“Security isn’t a one-off; it’s a commitment for the whole service life.”
Together, these actions show how SbD moves from principle to practice, mapping directly to the formal MoD and HMG principles set out below.
Q40 demonstrates what cyber-in-engineering delivers in practice with Secure by Design as the outcome.
The results are as relevant to CNI and commercial systems as they are to defence.
Apply this on your programme – what Q40 showed in practice can be applied to any product or system — in defence, CNI or regulated sectors:
For a full description of our key takeaways and more information about how Q40 meets our Secure by Design principles, register for the full case study here.