Early Warning from the NCSC: the free alert service small businesses can set up in five minutes

Most small businesses find out about a security problem the hard way: a customer complains, a bank calls, or the website stops working. The NCSC runs a free service that tries to tell you sooner. It is called Early Warning, and it takes about five minutes to set up. This post explains what it does, what it does not do, and how to make it useful without turning it into a job.

What Early Warning is

According to the NCSC's Early Warning page, it is a free service that emails UK organisations alerts about potential cyber attacks on their networks, so they can act sooner. The page says any organisation based in the UK can use it. The NCSC describes it as providing a basic layer of cyber security, and says it draws on NCSC, trusted public, commercial and closed feeds, including some privileged feeds that are not available elsewhere.

It is not new, and it is not niche. The NCSC Annual Review 2025 reports that 13,178 organisations had signed up by the end of the year. In April 2026, a government open letter to business leaders, signed by the Secretary of State for Science, Innovation and Technology and the Security Minister, included the instruction: "Follow NCSC advice and sign up to their Early Warning Service." The same letter pointed smaller firms to the NCSC Cyber Action Toolkit and asked businesses to adopt Cyber Essentials.

The three kinds of alert

The NCSC says Early Warning sends three types of alert:

• Incident Notifications: signs of an active compromise, such as a computer or device that looks to be infected with malware.
• Network Abuse Events: your assets being linked to malicious or undesirable activity, for example a device on your network scanning the internet.
• Vulnerability and Open Port Alerts: vulnerable services or unwanted applications that are visible from the internet, for example an exposed Elasticsearch service.

Alerts arrive by email in daily and weekly reports. The NCSC says the service averages 2,000 alerts a month across its users.

The Annual Review gives a sense of the scale. Across the year, alerts covered 316,343 customer IP addresses. Reports on 131,000 IP addresses suspected of malware or hacking compromise went to 1,350 organisations, and vulnerability reports covering 187,000 IP addresses went to 4,030 organisations.

What you need to register

The NCSC lists four things you need before you start:

• A MyNCSC account, which is free to create.
• Your organisation's name.
• Your organisation's public IP addresses and domain names.
• Contact details for the people who should receive alerts, at least a name and an email address.

The public IP address and domain name are the parts that trip people up. Your domain name is the address of your website and email, such as yourbusiness.co.uk. Your public IP address is the address your office broadband or hosting shows to the internet. Your internet provider, your web host or your IT support can tell you what yours is. If you do not know who owns or controls your domain, sort that out first; we cover it in who owns your domain name.

The NCSC says alerts are tailored only to the IP addresses and domains you register. That cuts both ways. If you register only your website domain and forget the office router, you will not hear about problems there. If your website is hosted by a third party, the NCSC's page does not set out how that is treated, so ask your host or developer what addresses to register and whether they already receive alerts for them.

What it does not do

This is the part to be honest about. The NCSC states that Early Warning should not be used as the only layer of defence for a network, and that it should complement your existing controls. It also says:

• It does not actively scan your networks. It relies on information from other networks.
• It only notifies you about attacks detected by its feed suppliers, so it cannot guarantee full coverage.

So silence is not proof that you are safe. Think of it as a smoke alarm rather than a security guard: cheap, quick to install, and worth having, but it does not replace locks, updates and backups.

Where it fits with the rest of your security

The alerts are only useful if someone reads them and something happens next. The NCSC's vulnerability management guidance gives a sensible frame. It says to understand which systems and software you have, who is responsible for what, and which vulnerabilities are present. It also says to apply updates as soon as possible, and ideally automatically, and to have a way to triage and prioritise when an update does not fix a problem or none exists yet. It suggests starting with a narrow scope, for example only critical systems, and widening later.

For a small business, that translates into a short list: know what is connected to the internet, keep it updated, and decide in advance who acts when an alert lands. If you rely on an IT provider, make sure they know the alerts exist and that the contact on the account is someone who will actually open them.

If an alert points at something you do not understand, such as an open port on a device you have never heard of, that is a question for your IT provider or web developer, not a reason to panic. If you do not have either, our cloud and security team can help you work out what an alert means.

What to do this week

• Create a free MyNCSC account.
• List your domain names, and ask your broadband provider or host for your public IP addresses.
• Register them with Early Warning, using a shared inbox such as security@ rather than one person's email, so alerts survive holidays and staff changes.
• Tell your IT provider or developer that the service is on, and agree who responds.
• Put a monthly reminder in the diary to check that the registered addresses still match reality, especially if you change broadband provider, hosting or domain registrar.

The reasonable view

I looked for reaction to the service from small businesses and technical communities. There is little independent commentary: a search of Hacker News for the service turned up no discussion, and I found no survey of small business attitudes, so I will not pretend there is a verdict. What the official material does say is consistent: it is free, quick, limited in what it can see, and meant as one layer among several. For five minutes of effort and no cost, that is a fair trade for most small firms.