ControlPlane's UK Public Sector Security Research: Over 100 Vulnerabilities Reported

The UK public sector is a global leader in open source, having spent over a decade coding in the open, a practice that has produced over 25,600 public repositories, representing around 43% of global public sector open source repositories, compared to 33,800 across all other nation states combined.

Embodying Linus's Law, this openness and transparency enable proactive security and bug evaluations, including recent research conducted by the AI Security team at ControlPlane. Without open source engineering, we'd have been less impactful in improving vulnerability management by utilising AI tooling.

Vulnerability Disclosure and Triaging

In total, ControlPlane's security review surfaced over 1,000 issues; a subset of 118 critical vulnerabilities was appraised through our internal quality assurance and then submitted through the Government Vulnerability Reporting Service. At the time of publishing, over two-thirds (84 of 118) of the reported vulnerabilities were categorised as High or Critical by the Vulnerability Reporting Service's CVSS calculator.

Severity of the 118 reports:

• Critical: 23
• High: 61
• Medium: 29
• Low: 3
• Unrated: 2

The details for the first of these vulnerabilities, an access-control gap in the Department for Education's "Get help buying for schools" service, which supports schools through public procurement and supplier frameworks, are now available.

Further vulnerability information will be provided in the following weeks as remediation conversations continue with relevant stakeholders. Of the 118 reported vulnerabilities, in some instances, triage classified them as not warranting a priority fix, and/or they've been closed as informational.

Resolved Reports

As of publishing, 15 reports have been marked as resolved, and when a report successfully reaches an engineering department, remediation has been fast:

1. Median resolution time: 13 days
2. Fastest fix: a live sysadmin credential was revoked in approximately 1 hour, and the ticket was closed the next day

Time from report to fix:

• 1 day: 4 reports
• 8 to 13 days: 4 reports
• 50 days: 1 report
• 88 to 99 days: 3 reports
• 110 to 123 days: 3 reports

Utilising Continuous AI Scanning

The news cycle often focuses on sophisticated, multi-stage attack chains and frontier AI threats; the observed vulnerabilities fall squarely within well-understood, foundational categories. Every vulnerability identified, including a CVSS 10.0 issue that exposed tenant-wide read and write access across a single department's Microsoft 365 estate, falls within the OWASP Top Ten.

Most public sector services undergo an IT Health Check (ITHC) every 12 months and at significant milestones (including public launch), conducted by CHECK, CREST or similar-accredited penetration testers at a cost of thousands of pounds per service.

The Opportunity Posed with Continuous Testing

The identified vulnerabilities were found using Claude's Opus and Sonnet, and many of the same vulnerabilities were proven to be identifiable with cheaper, local Gemma-class models without privileged access or guardrail bypasses.

An ITHC routinely costs thousands of pounds; by comparison, this research had the following operational metrics using the frontier AI models:

• Compute cost: Approximately $50 in AI tokens per service
• Execution rate: One service every four hours with some concurrency on standard hardware

This is a repeatable workload that could naturally fit into existing CI/CD pipelines running automated scans on every AI model release or software update, rather than waiting 12 months between audits.

This is not to replace the need for regular, in-depth penetration testing or deep architectural reviews. However, for well-understood OWASP Top Ten vulnerabilities that have been present for years and have survived several ITHC cycles, the data highlights a clear coverage gap.

Need help assessing your organisation?

ControlPlane works to ensure organisations stay ahead in AI and security, including threat modelling and maturity assessments.

Wanting to understand your organisation's position? Find out more about our AI Security services, or get in touch.