NCSC New Proactive Notifications Service Reports Vulnerabilities to System Owners

The National Cyber Security Centre (NCSC) has unveiled a new pilot program designed to help organizations identify and fix security weaknesses before malicious actors can exploit them.

Known as the Proactive Notifications Service, this initiative responsibly reports vulnerabilities directly to system owners, offering them a chance to protect their networks and data.

Operated in partnership with internet security firm Netcraft, the service scans the internet for organizations running software with known vulnerabilities.

These scans rely on publicly available information, such as software version numbers. When a vulnerability is detected, the service sends an alert to the organization, encouraging them to install necessary updates.

The NCSC describes this as a “Minimum Viable Product” (MVP), meaning it is currently a pilot project intended to assess the value of such direct interventions to national cybersecurity.

With phishing attacks on the rise, the NCSC has provided clear guidelines to help recipients verify that an alert is legitimate.

• System owners should look for the following signs: Sender: The email will always come from a netcraft.com address.
• Format: The email will be in plaintext. While it may contain links, it will never include attachments.
• Content: The message will never ask for personal information, payment, or passwords.

If recipients are unsure about a link, they are advised to copy and paste the text into a browser rather than clicking directly.

For those concerned about the validity of a message, the NCSC advises contacting acdenquiries@ncsc.gov.uk. Organizations can also opt out of these notifications by contacting Netcraft support.

This service is part of the NCSC’s wider “Active Cyber Defence” strategy, which aims to make the UK a safer place to live and work online.

However, the agency emphasizes that this service does not replace comprehensive security management. Organizations remain ultimately responsible for their own networks. For deeper protection, the NCSC also recommends its Early Warning service.

Unlike proactive notifications, Early Warning is a free service that alerts organizations to potential threats and malicious activity specifically targeting their networks, enabling faster incident response.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.