The NCSC will warn you about attacks for free. Here’s how to sign up.

NCSC Early Warning is a free service from the UK's National Cyber Security Centre. Tell it your business's internet addresses and domain names, and it emails you when something linked to them looks infected, vulnerable or up to no good. This guide shows you how to sign up for NCSC Early Warning in about ten minutes, and what to do when an alert lands.

It's one of the three things the government asked every organisation to do in this week's NCSC Annual Review, alongside Cyber Essentials and the Cyber Resilience Pledge. Nearly 20,000 organisations have signed up, 52% more than last year, and the NCSC used it to warn 8,500 of them about a suspected compromise.

What Early Warning actually does

Security researchers, internet companies and the NCSC itself constantly spot things going wrong online: infected machines calling home, servers scanning the internet, software left exposed. Early Warning matches those findings against the addresses you've registered and emails you about anything that's yours.

The alerts come in three types:

Alert	What it means	Example
Incident notification	Something on your network has probably been compromised	A device on your network looks infected with malware
Network abuse event	Your addresses have been linked to malicious or unwanted activity	Something on your network is scanning the internet
Vulnerability and open port alert	You've got a vulnerable service, or something exposed to the internet that probably shouldn't be	An old remote access portal, or a database open to the world

It doesn't scan or touch your systems. It works from information the NCSC already has, so there's nothing to install and nothing that can break.

What you need before you start

• Your organisation's name, as you'd like it to appear.
• Your public IP addresses. These are the addresses your office, servers and anything you host appear from on the internet. More on finding them below.
• Your domain names, for example yourbusiness.co.uk and any others you own.
• Who should get the alerts. At least a name and email address for each contact.

How to sign up for NCSC Early Warning, step by step

1. Create a MyNCSC account. Go to my.ncsc.gov.uk and register with your work email. Turn on two-factor authentication in your account settings straight away.
2. Join or create your organisation. If you're the first person from your business, you'll set up the organisation and the NCSC approves you as its first admin. That approval isn't always instant, so don't worry if you have to wait a little.
3. Add your assets. Enter your public IP addresses and domain names, and tick Early Warning as the service to run on them.
4. Add your alert contacts. Use a shared mailbox like security@ or it@ plus a named person, so alerts don't vanish when someone is on holiday or leaves.
5. Make sure the emails arrive. Add the NCSC's sending address to your safe senders list, and check your junk folder after the first daily or weekly report.

Finding your public IP addresses

This is the bit that trips people up. A few pointers:

• Your office. From a computer in the office, search "what is my IP". If your broadband has a fixed (static) IP, that's the one to register. Your provider's paperwork or router admin page will say. If it changes from time to time, ask your provider about a static IP, or register your domains for now.
• Things you host. If you run your own server, VPN, remote desktop or firewall, add those addresses too. They're often the very things alerts are about.
• Your website and email. If they're with a hosting company or Microsoft 365, register your domain names. Don't add shared IP addresses you don't control.
• Your IT provider. If someone looks after your IT, ask them for the list. Better still, ask them to set Early Warning up with you and add themselves as a contact.

Mostly staff working from home? Register your domains and any office or VPN addresses. It still covers a lot.

What to do when an alert arrives

1. Don't ignore it, and don't panic. Most alerts are about something exposed or out of date, not a live attack.
2. Work out which device or service it's about. The alert shows the address, the date and what was seen.
3. Treat incident notifications as urgent. If it says a machine is probably infected, isolate it from the network and get help. Our incident response page explains what happens next.
4. Fix vulnerability alerts quickly. Update the software, or close it off from the internet if nobody needs it there. Cyber Essentials expects high and critical fixes within 14 days, and sooner is better.
5. Write down what you did. A line in a log is enough. It helps next time, and it's useful evidence for insurers and certifications.

What Early Warning won't do

It only knows about what other people have seen from the outside, so a quiet week doesn't mean you're secure. The NCSC is clear it shouldn't be your only layer of defence. Think of it as a smoke alarm, not a sprinkler system: keep up with updates, multi-factor authentication and tested backups as well.

It also won't tell you when your team's passwords turn up in someone else's data breach, which is how a lot of account takeovers start. That's the gap fromIT's dark web monitoring fills. It watches for your business email addresses in breach data and tells you who needs to change what, from £2 per person a month. You can start with a free breach check of your domain.

How this fits with Cyber Essentials

Early Warning doesn't give you a certificate, but it supports two of the five Cyber Essentials controls: security update management and secure configuration. An alert about an exposed or out-of-date service is exactly the kind of thing an assessor would ask about. Not sure where you stand? Try our free Cyber Essentials readiness check.

FAQ

Is NCSC Early Warning really free?

Yes. It's free for any organisation based in the UK, whatever its size, and there's no catch or upsell.

Will the NCSC scan or access our systems?

No. Early Warning doesn't scan your network. It matches information the NCSC already receives from its own work and trusted partners against the addresses and domains you register.

We don't have a static IP address. Is it still worth it?

Yes. Register your domain names and any fixed addresses you do have, such as a VPN or hosted server. If your office IP changes, update it in MyNCSC when it does, or ask your broadband provider for a static one.

Can our IT provider sign us up?

They can help, and it's worth asking. Make sure someone in your business is also an admin and an alert contact, so you still hear about problems if you change provider.

How often will we get emails?

You'll get daily and weekly reports when there's something to tell you. Plenty of businesses go weeks without an alert, which is fine.

Sources

• Early Warning (NCSC)
• MyNCSC (NCSC)
• NCSC Annual Review 2026 (NCSC, 3 November 2026)