NCSC Proactive Notifications Service
A service that responsibly reports vulnerabilities to system owners to help them protect their services
Have you received an email from the NCSC Proactive Notification Service?
Here’s how you can be sure this email is legitimate:
- the email has come from a netcraft.com address
- the email is in plaintext format - it may contain clickable links, but if you are concerned by them, you can copy and paste the text into a browser
- the email does not include any attachments
- the email does not ask you for personal or other information, or for payment
If you have received such an email and are still concerned by it, you can contact [email protected] for further advice.
If you have received this email in error or do not wish to receive these notifications, please contact [email protected].
About the NCSC Proactive Notifications Service
Working with Netcraft, the NCSC:
- identifies organisations operating without essential security services
- sends these organisations emails to help them install software updates that can reduce vulnerabilities
This notification is based on scanning open source information, such as publicly available software versions. The service was launched to responsibly report vulnerabilities to system owners to help them protect their services.
This coordinated approach reinforces the broader national effort to make the UK the safest place to live and work online. The service is part of the NCSC’s new approach to Active Cyber Defence, and will be delivered as a Minimum Viable Product (MVP) as a pilot, enabling a thorough assessment of its value and the advantages it can offer.
How the NCSC Proactive Notifications Service works
The service discovers vulnerabilities using Netcraft’s reach across the internet.
- Netcraft and the NCSC work together to mutually agree in-scope vulnerabilities for scanning.
- Scanning and notifications are based on external observations, such as the version number publicly advertised by the software, and are in compliance with the Computer Misuse Act.
- Our default contact method is to contact relevant parties via email.
Organisations are ultimately responsible for the security of their own networks and data, and for determining the steps to protect themselves. This includes identifying and addressing vulnerabilities in their systems. The Proactive Notifications Service does not cover all systems or vulnerabilities, so must not be relied upon as the sole source of security alerts. It is for organisations to determine whether and how to implement the recommendations from this service.
NCSC Early Warning
Every day, UK organisations are targeted by cyber criminals – whether for their data, their funds, or simply to cause disruption. Early Warning is a free service from the NCSC that notifies organisations of potential cyber threats before they cause harm.
By signing up, you’ll receive timely alerts about malicious activity targeting your network – giving you the chance to take action early and reduce risk. The more information you share with the NCSC Early Warning service about your IT estate, the more effectively monitoring can be tailored, ensuring you receive relevant, actionable notifications.
Learn more about Early Warning
