The UK National Cyber Security Centre (NCSC) has started a pilot of a service called Proactive Notifications that will inform organisations of vulnerabilities discovered in devices and services exposed on the internet. The service is delivered through cybersecurity firm Netcraft and is based on analysis of publicly available information and internet scanning.
The NCSC said the programme will identify organisations that lack essential security services and contact them with specific software update recommendations aimed at addressing unpatched flaws. Recommendations may cite particular CVEs or broader issues such as weak encryption, and scanning will rely on external observations such as software version numbers, the agency states in its guidance.
The agency noted emails from the service will come from netcraft.com addresses, will not include attachments, and will not request payments or personal information. The pilot will cover UK domains and IP addresses associated with Autonomous System Numbers (ASNs) in the country, but the new service will not detect every exposed system or vulnerability.
Organisations are advised not to rely on Proactive Notifications as their sole source of alerts and are encouraged to enrol in the NCSC’s more mature Early Warning service for timely notifications tied to active threats and suspicious activity; information on signing up is available on the NCSC site. Early Warning aggregates public, private and government intelligence and cross-references feeds with enrolled domains and IP addresses to spot signs of compromise.
The NCSC said Proactive Notifications is intended to harden systems before direct threats appear, complementing Early Warning which detects activity that slips through. The agency has not provided a timeline for when the service will move out of its pilot phase.