NCSC reports on second year of cyber defence at scale
.jpg)
The UK’s National Cyber Security Centre releases a report on the second year of its Active Cyber Defence programme to demonstrate its effects in the public sector and wider UK cyber ecosystem.
A scam to defraud thousands of UK citizens using a fake email address spoofing a UK airport is one of a wide range of cyberattacks prevented by the National Cyber Security Centre (NCSC), a report reveals.
The criminal campaign is one of the case studies in the NCSC’s report on the second year of its Active Cyber Defence (ACD) programme designed to reduce the harm from commodity cyber attacks against the UK.
In August 2018, the cybercriminals behind the campaign tried to send more than 200,000 emails purporting to be from a UK airport, which the NCSC did not name, using a non-existent gov.uk address in a bid to defraud people.
However, the emails to members of the public asking them to pay a fee to receive a refund never reached the intended recipients’ inboxes. This is because the NCSC’s ACD system automatically detected the suspicious domain name and the recipients’ mail providers never delivered the spoof messages. The real email account used by the criminals to communicate with victims was also taken down.
According to the report, a combination of ACD services has helped HMRC’s own efforts in “massively reducing” the criminal use of their brand. HMRC was the 16th most phished brand globally in 2016, but by the end of 2018, it was 146th in the world.
Ian Levy, the NCSC’s technical director and author of the ACD report, said: “These are just two examples of the value of ACD – [it] protected thousands of UK citizens and further reduced the criminal utility of UK brands. A concerted effort can dissuade criminals and protect UK citizens.
“While this and other successes are encouraging, we know there is more to do, and we would welcome partnerships with people and organisations that wish to contribute to the ACD ecosystem so that together we can further protect UK citizens.
“This second comprehensive analysis we have undertaken of the programme shows that this bold approach to preventing cyber attacks is continuing to deliver for the British public.”
Other findings related to the ACD programme cited in the report include a primary school involved in the spread of a Ramnit worm infection because its antivirus system was not working; a public sector organisation malware infection through a malicious USB stick being plugged into the network;a public sector organisation breach because its employees had downloaded unauthorised software; and more than 300 public sector networks still using Windows XP despite the fact that Microsoft security support for the operating system ended in 2014.
Introduced by the NCSC in 2016, ACD is an interventionist approach that stops millions of cyber attacks from ever happening. It includes the pioneering programmes Web Check to scan websites for vulnerabilities, Mail Check to control abuse of email domains, Protective DNS for the public sector and a Takedown Service to remove malicious content.
Components are continually being added to the ACD programme and others include Domain Discovery to help system owners understand what internet domains they have registered, a Vulnerability Disclosure Platform to make it easy to report vulnerabilities in government services, and a Suspicious Email Incubator to help the public report on suspicious stuff and automatically take protective action.
The ACD technology, which is free at the point of use, intends to protect the majority of the UK from the majority of the harm from the majority of the attacks the majority of the time.
Other key findings for 2018 from the second ACD report include that the NCSC took down 22,133 phishing campaigns hosted in the UK delegated IP space, totalling 142,203 individual attacks; and 14,124 UK government-related phishing sites were removed.
The report also found that phishing campaigns spoofing HMRC fell from 2,466 in 2017 to 1,332 in 2018. These figures relate to 16,064 spoof sites in 2017 and 6,752 sites in 2018.
It also discovered that the total number of takedowns of fraudulent websites was 192,256, across 2018, with 64% of them down in 24 hours; and the number of individual web checks run has increased almost 100-fold, with the NCSC issuing a total of 111,853 advisories direct to users in 2018.
“One of the founding principles of the NCSC was making decisions based on evidence, and being as transparent as possible in that,” said Levy in a blog post.
“The report – the second in what will become an annual release – uses real, unvarnished data to provide an evidence base to judge the effectiveness of the ACD measures. In some cases, we haven’t managed to do as much as we hoped, but work will continue to scale these services and, more importantly, the effects they have, both in the UK and internationally,” he wrote.
Minister for the Cabinet Office David Lidington said the UK is safer since the launch of the government’s cyber strategy in 2016. “Over the past three years, backed by a £1.9bn investment, we have revolutionised the UK’s fight against cyber threats as part of an ambitious programme of action,” he said.
“The statistics and examples in this report speak for themselves. They outline the tangible impact that Active Cyber Defence is having, and how it is a key building block in improving cybersecurity in the UK now, and in the future.”
The report also looks to the future of ACD, highlighting a number of areas in development. These include:
- The work between the NCSC and Action Fraud to design and build a new automated system which allows the public to report suspicious emails easily. The NCSC aims to launch this system to the public later in 2019;
- The development of the NCSC Internet Weather Centre, which will aim to draw on multiple data sources to improve the understanding of the UK’s digital landscape;
- Plans to explore developing an Infrastructure Check service: a web-based tool to help public sector and critical national infrastructure providers scan their internet-connected infrastructure for vulnerabilities;
- Research into finding additional ways to use the data created as part of the normal operation of the public sector protective DNS service to help users better understand and protect the technologies in use on their networks.
“We believe that evidence-based cybersecurity policy – driven by evidence and data rather than hyperbole and fear – is a possibility,” Levy wrote in the report.
“We are not expecting our interventions to be perfect or to defend against every single type of cyber attack. However, we continue to believe that government actively doing something, providing real services and generating real data and analysis has to be a first step in demystifying cybersecurity, and beginning to tackle the impacts of a cyber attack at scale,” he said.
source computerweekly
Industry: Cyber Security

Latest Jobs
-
- Account Manager - IT Services
- Germany
- €90000 plus OTE and Car
-
Are you a deal closer with a hunter mindset? Do you know how to uncover business pain points, and turn them into long-term digital transformation partnerships? Our Client are growing their sales force across Germany and looking for an ambitious, straight-talking Account Manager to take the lead on new client acquisition. You’ll focus on mid-sized to large enterprises across Germany helping to shape their digital future with tailored IT solutions in Workplace, Cloud, and Security. • Drive Growth: Own the full sales cycle for new business across your region. • Solution Sell: Build bespoke offers in Security, Digital Workplace and Cloud solutions • Build Relationships: Establish a solid pipeline through smart prospecting, marketing-driven leads, and your own network. • Represent a brand known for trust, delivery, and tech excellence—with 4,000 employees globally and a growing team within Germany. What You Bring • Proven new logo sales experience in the IT services space (not hardware!) • Deep knowledge in one or more of: Cybersecurity, Digital Workplace, or Cloud • Confidence to lead enterprise deals and pitch directly to senior stakeholders • Fluent German and good English skills Sind Sie ein Abschlussprofi mit Hunter-Mentalität? Wissen Sie, wie man geschäftliche Pain Points identifiziert und in langfristige Partnerschaften zur digitalen Transformation verwandelt? Unser Kunde baut derzeit sein Vertriebsteam in ganz Deutschland aus und sucht eine ambitionierte, ehrliche Persönlichkeit als Account Manager, die den Lead bei der Neukundengewinnung übernimmt. Ihr Fokus liegt auf mittelständischen bis großen Unternehmen in Deutschland, denen Sie mit maßgeschneiderten IT-Lösungen in den Bereichen Workplace, Cloud und Security den Weg in die digitale Zukunft ebnen. Ihre Aufgaben • Wachstum vorantreiben: Verantwortung für den gesamten Vertriebszyklus im Neugeschäft Ihrer Region. • Lösungsorientierter Vertrieb: Entwicklung individueller Angebote in den Bereichen Security, Digital Workplace und Cloud-Lösungen. • Beziehungen aufbauen: Aufbau einer stabilen Pipeline durch gezielte Ansprache, marketinggenerierte Leads und Ihr eigenes Netzwerk. • Marke repräsentieren: Werden Sie Teil eines Unternehmens mit 4.000 Mitarbeitenden weltweit und einem stark wachsenden Team in Deutschland – bekannt für Vertrauen, Verlässlichkeit und technologische Exzellenz. Was Sie mitbringen • Nachgewiesene Erfahrung in der Neukundenakquise im Bereich IT-Services (kein Hardwarevertrieb!) • Fundiertes Wissen in mindestens einem der Bereiche: Cybersecurity, Digital Workplace oder Cloud • Selbstbewusstes Auftreten im Umgang mit Enterprise-Deals und Entscheidungsträgern auf Top-Level • Verhandlungssichere Deutschkenntnisse und gute Englischkenntnisse
-
- Senior SOC Analyst Level 3. Microsoft Security stack | Ability to achieve SC Clearance
- London
- To attract the right person
-
Job Title: Senior SOC Analyst Level 3. Microsoft Security stack | Ability to achieve SC Clearance Location: Hybrid remote | London / Berkshire Overview: Senior SOC Analyst Level 3 to join a specialist Managed Security Services business. You will be responsible for advanced threat hunting / triage, incident response etc with a strong focus on the Microsoft Security Stack. Key Responsibilities: Lead and resolve complex security incidents / escalations Conduct advanced threat hunting using the Microsoft Security Stack. Build, optimise and maintain workbooks, rules, analytics etc. Correlate data across Microsoft 365 Defender, Azure Defender and Sentinel. Perform root cause analysis and post-incident reporting. Aid in mentoring and upskilling Level 1 and 2 SOC analysts. Required Skills & Experience: The ability to achieve UK Security Clearance (SC) – existing clearance ideal. (Sorry no visa applications) Current experience working with a SOC environment Microsoft Sentinel: Development and tuning of custom analytic rules. Workbook creation and dashboarding. Automation using Playbooks and SOAR integration. Kusto Query Language (KQL): Writing complex, efficient queries for advanced threat hunting and detection. Correlating data across key tables (e.g., SignInLogs, SecurityEvent, OfficeActivity, DeviceEvents). Developing custom detection rules, optimising performance, and reducing false positives. Supporting Sentinel Workbooks, Alerts, and Playbooks through advanced KQL use. Deep understanding of incident response, threat intelligence and adversary techniques (MITRE ATT&CK framework). Strong knowledge of cloud and hybrid security, particularly within Azure. Additional Requirements: Must hold or be eligible to achieve a minimum of Security Clearance (SC) level. Nice to have certifications (e.g., SC-200, AZ-500, GIAC) are desirable. Strong problem-solving and analytical skills. Excellent communication for clear documentation and team collaboration. Please follow Wheaton’s Law.
-
- New Business Sales Hunter | Cyber Security (UK Based)
- London
- To attract the right person
-
New Business Sales Hunter needed | Cybersecurity (UK Based) Are you looking for uncapped commission, a fun and sociable team that drives success with no politics? If so...You must Be UK based - and able to achieve UK SC clearance. (sorry no visas) Have a demonstrable history of sales success in Cyber Security Follow Weatons law. The role: Seeking a proven New Business Sales Hunter to join an established, successful and expanding cyber security firm. New business focused - £1m GP year one target (ramped). Sell a blend of security services & professional services. Ideal experience selling some or all of the following Cyber strategy & risk management Managed detection & response (MDR) Penetration testing Compliance & audit support You: Strong cybersecurity/IT services sales track record. Confident selling into mid-market & enterprise. UK based - London commutable 1x per week. Hunter mindset, full sales cycle ownership. Don't just send an email to apply give me a call on 07884666351
-
- CyberArk Architect
- London
- Upto £110,000 plus bonus and benefits
-
Are you ready to lead from the front and drive innovation in the Identity & Access Management (IAM) space? We’re looking for a seasoned CyberArk Architect who has CDE-CPC ideally or experience with privilege Cloud, someone who can lead with vision, execute with precision, and inspire teams to deliver excellence. As a key leader in our organisation, you’ll bring your strong business acumen and a technology-focused, innovative mindset to the table. You’ll be driving strategic initiatives, shaping transformation programs, and empowering teams to think big and deliver even bigger. Acting as a subject matter expert in CyberArk Leading strategic transformations in: Identity Governance Privileged Access Management (PAM) Access Management Customer Identity and Access Management (CIAM) Building and maintaining strong, collaborative relationships within the team Communicating clearly and confidently — both written and verbal — to deliver updates, raise potential issues, and share insights If you are interested in the above position we are looking for people with: deep expertise and a successful track record in IAM strategy, delivery, or assurance with CyberArk Hold relevant certifications such as CDE in Privileged Cloud or Guardian Have experience in a client-facing role (preferred, but not essential) Thrive in a hybrid working environment and are available to work from our or client London office three days a week Lead with clarity, communicate with impact, and adapt quickly to changing priorities