New method could close major gaps in Danish cyber defence
A research project aims to raise awareness about the uncertainties involved in the acquisition and use of so-called “off-the-shelf” software and operating systems, which are currently used by both the Danish Armed Forces and institutions critical to national infrastructure. In the long term, the goal is to equip critical sectors with tools that enable them to verify the security of their software.
Written 8 April, 2026 07:26 by Niels Thrane
In recent years, headlines about hacking incidents targeting critical companies and institutions have been numerous. Hundreds of thousands of credit card numbers were leaked from Nets, a Russian backdoor allowed access to Danish emails for several years, and not least the NotPetya attack caused billions of dollars in damage worldwide—along with many other incidents we never hear about. For this reason, the need to verify software is urgent.
This is the message from Willard Rafnsson, Associate Professor at IT University of Copenhagen and one of the coordinators of the project “Full-Stack Cybersecurity for the Armed Forces.” The project is funded by the National Defence Technology Center (NFC) and is a collaboration between researchers from IT University of Copenhagen, Aalborg University, Aarhus University, and the University of Copenhagen.
“If we don’t make changes, we risk that, in the event of a conflict where equipment must work together, for example, the Russians could say: ‘Look, there’s a tank running outdated software – let’s take control of that.’ Or an enemy might simply gain access to our command-and-control network and thereby obtain full insight into our strategies and communications. Many things can go wrong if you don’t have a solid security foundation in your technology,” says Willard Rafnsson.
Full-stack cybersecurity
According to Rafnsson, one of the key problems is that organisations largely take suppliers at their word when they claim that the software they deliver is secure. Experience has shown that this is not sufficient. Security must be verifiable at both the software and hardware level, a concept Rafnsson refers to as full-stack security:
“More than 60 percent of our software is vulnerable. Last year, 22 companies in the Danish energy sector were hit by a cyberattack due to a weakness in their Zyxel firewall. A hacker only needs to find a single vulnerability somewhere in the entire system’s software-hardware stack. For example, are we absolutely certain that there isn’t a single vulnerability in the more than 20 million lines of code controlling Denmark’s F-35 fighter jets? We need to rethink IT for the Armed Forces with cybersecurity in mind. The military needs evidence that a system cannot be broken. The most compelling evidence is a mathematical proof,” says Rafnsson.
Hard guarantees
Verification tools already exist. For example, DARPA, a research agency of the U.S. Department of Defense, has long invested in software correctness research and has developed tools related to what Rafnsson’s project aims to achieve. However, while many existing initiatives focus mainly on ensuring that software runs correctly and behaves as intended, the Danish project builds on this by placing a strong emphasis on security.
“We go all the way. We want to equip the Armed Forces with tools to scrutinise proofs of correctness for purchased software, tools to securely encapsulate and rewrite software that lacks such proof, and a secure operating system to run that software on. This would give the Danish Armed Forces a solid foundation for meeting the growing demands for cybersecurity. If this becomes reality, Denmark will no longer have to rely on the claims of other companies or countries about whether their technology is correct,” says Rafnsson.
Many potential benefits
The project is now a little more than halfway through a process in which researchers—working with partners such as the Danish Defence Acquisition and Logistics Organisation and other public and private companies—are consolidating existing knowledge and laying the groundwork for future development in this field. According to Rafnsson, if these verification tools become reality, the benefits will extend far beyond the Armed Forces.
“In the long term, this could also be a significant advantage for smaller software companies. Right now, verification processes are lengthy and very costly—factors that can discourage talented developers from working on projects that require high levels of security. Our verification tools could make the path from concept to a usable, secure product significantly shorter and more cost-effective.”
The project “Full-Stack Cybersecurity for the Armed Forces” will run until December 2026. The hope is that the research group can then continue with support from the National Defence Technology Center and Innovation Fund Denmark. In the longer term, the ambition is to secure support from programmes such as the European Defence Fund (EDF), NATO, or Horizon Europe, enabling the development of a range of tools that will allow the Danish Armed Forces to obtain guarantees that the software running on their equipment is secure and trustworthy.
Jari Kickbusch, phone 7218 5304, email jark@itu.dk