The UK’s National Cyber Security Centre (NCSC) offers a free Early Warning service that notifies organisations of suspected cyberattacks, compromised systems and vulnerabilities affecting their networks. By providing information about potentially malicious activity, the service helps organisations identify and investigate security issues that might otherwise go unnoticed.
Early Warning is available to UK organisations with a domain name and a static IP address, regardless of size or sector. It requires no specialist software installation and can complement existing cybersecurity controls by providing access to threat intelligence collected from multiple sources.
What Is the NCSC Early Warning Service?
The NCSC Early Warning service is part of the UK government’s Active Cyber Defence (ACD) programme, an initiative designed to reduce the impact of cyber threats on UK organisations.
It uses threat intelligence gathered by the NCSC and trusted public, commercial and closed sources and several privileged feeds which are not available elsewhere, to identify potentially malicious activity associated with an organisation’s registered public IP addresses and domain names. When relevant activity is detected, the service sends notifications to designated contacts, enabling them to investigate potential security issues. This distinction is important: Early Warning provides an additional source of security intelligence rather than comprehensive, real-time monitoring of an organisation’s IT environment.
What Types of Cyber Threats Does Early Warning Identify?
The NCSC groups Early Warning notifications into three categories: suspected compromises, malicious or undesirable network activity, and potential vulnerabilities. Network abuse events and incident notifications are sent daily, while vulnerability and open port alerts are sent weekly.
Incident Notifications
Incident notifications highlight activity suggesting that a system may already be compromised. For example, a device on an organisation’s network may have been seen communicating with infrastructure linked to malware. These alerts should be investigated promptly to confirm whether the device is infected, identify any other affected systems and decide whether containment or remediation is needed.
Network Abuse Events
Network abuse events indicate that an organisation’s assets have been associated with malicious or undesirable activity. For example, a device may have been detected scanning the internet, which could mean it has been compromised or is being used without authorisation.
These alerts do not necessarily confirm a breach. However, they give IT teams a starting point for investigation, alongside firewall logs, endpoint telemetry and other security data.
Vulnerability and Open Port Alerts
These alerts identify potentially vulnerable services, or applications exposed to the internet that may not need to be. Examples include software with known vulnerabilities and services that are publicly accessible when they should be restricted.
An open port is not automatically a vulnerability, as some services legitimately need to be reachable from the internet. The key question is whether each exposed service is necessary, correctly configured and protected against unauthorised access.
How Can Early Warning Benefit UK Organisations?
Early Warning can help organisations identify security concerns that may not have been detected through their existing monitoring arrangements. Its value is particularly relevant where internet-facing systems, third-party infrastructure or limited internal security resources create gaps in visibility.
The service can also support vulnerability management by highlighting potentially exposed services or known weaknesses that require attention. An organisation might, for example, receive a notification about a vulnerable application on a public-facing server, prompting it to verify the software version, assess its exposure and apply an appropriate security update.
The NCSC has documented a case that involved a UK critical infrastructure supplier whose Microsoft Exchange environment contained a web shell associated with vulnerabilities disclosed in 2021. Although initial checks and patching had taken place, the compromise had not been identified. Early Warning subsequently provided information that helped bring the issue to the supplier’s attention for remediation.
The scale of the service also demonstrates the extent of the activity it identifies. According to the NCSC Annual Review 2025, Early Warning had 13,178 registered organisations by the end of its reporting period. During the year, it issued alerts relating to 316,343 IP addresses, including reports of suspected compromise or malware affecting approximately 131,000 IP addresses. These figures represent reported indicators and affected IP addresses, not confirmed numbers of successful cyberattacks.
Who Can Register for NCSC Early Warning?
Early Warning is free for UK organisations with a static public IP address or domain name. The service can be used by businesses, charities, public-sector bodies and other eligible organisations.
Registration is managed through MyNCSC, the NCSC’s platform for accessing its cybersecurity services. Organisations need a MyNCSC account, their organisation’s name, relevant public IP addresses and domain names, and the names and email addresses of contacts who should receive notifications.
Once registered, organisations can receive relevant notifications through daily and weekly email reports. Registration details and eligibility information are available on the official NCSC Early Warning webpage.
What Assets Should Be Registered?
Having an active account does not automatically mean all your relevant assets are covered. To receive relevant alerts, you should register:
- Public static IP addresses: Including any static public IP address assigned to your office router or firewall by your Internet Service Provider (ISP), as well as other static public IP addresses used by your organisation, such as those associated with servers, VPNs or other internet-facing infrastructure.
- Domain names: All domains your business owns, including your website address and domains that are registered but not currently in use.
- Notification contacts: Ensure the appropriate people receive alerts, and their contact details remain up to date. If you would like Tivarri to receive alerts directly and assess whether remedial action is needed, please add [email protected] as one of your notification contacts.
Missing assets or notification contacts could mean important alerts are overlooked.
What Should Organisations Do When They Receive an Alert?
An Early Warning notification identifies a potential security concern; it does not establish the full extent of an incident or resolve the underlying issue. Organisations therefore need a process for reviewing alerts and determining the appropriate response.
The first step is to verify which system or service the notification relates to. This may involve checking asset inventories, IP address assignments, network configurations and relevant system logs. Organisations using third-party hosting or managed infrastructure may also need to establish whether the affected asset is operated internally or by an external provider.
Once the asset has been identified, the reported activity should be assessed against available evidence. A suspected malware infection may require endpoint investigation and containment, while a vulnerability notification may require verification of the affected software, review of existing security controls and remediation.
The response should reflect the nature and severity of the finding. Where a compromise is suspected, organisations should follow their incident response procedures. It is also useful to retain a record of the notification, investigation findings and corrective actions. This helps establish whether the issue has been resolved and provides a reference if similar activity is detected later.
What Are the Limitations of Early Warning?
Early Warning is not a replacement for endpoint protection, network monitoring, vulnerability management or incident response capabilities. Its coverage depends on the information available through the NCSC’s intelligence sources and the accuracy of the assets registered by each organisation. Consequently, the absence of a notification should not be interpreted as confirmation that a network is secure.
The service also does not provide comprehensive visibility into internal network activity, user account behaviour or every threat affecting cloud-based applications. Organisations still require appropriate security controls to detect and respond to risks outside the service’s coverage.
For Early Warning to remain useful, registered assets and notification contacts should be kept up to date. Changes to public IP addresses, domain names or technical responsibilities may affect whether relevant alerts reach the appropriate individuals.
Registration Alone Does Not Guarantee Alerts
An active account is not the same as an active Early Warning setup. Proper configuration is essential to receiving relevant threat notifications. When registering for the NCSC Early warning service, it is important that you add the publicly accessible digital assets that your organisation owns or manages. This includes URLs, domain names, etc. Without these assets, the service has nothing to monitor against its threat intelligence sources, meaning organisations may not receive relevant alerts despite having an active account.
Organisations should ensure that alerts reach the appropriate people and that their contact details are kept up to date. If you use a managed service provider (MSP), include them as a notification contact so they can receive relevant alerts and help coordinate the response.
Conclusion
The NCSC Early Warning service gives UK organisations free access to intelligence about suspected compromises, malicious network activity and potentially vulnerable internet-facing systems. Its principal value is the additional visibility it provides into security issues that may otherwise go undetected. However, the effectiveness of these notifications depends on organisations being able to identify affected assets, investigate the findings and take appropriate corrective action.