Cybersecurity
2020 Active Cyber Defence Report: Key Achievements and Practical Guidance for SecOps
The NCSC’s 2020 Active Cyber Defence (ACD) report highlights how the programme supported UK organisations during the pandemic, expanding remote‑work tools and threat‑intel sharing. Defenders should leverage ACD services, threat‑intel feeds, and training resources to strengthen resilience against evolving attacks.
The NCSC’s fourth‑year ACD report focuses on 2020, a year when the pandemic forced rapid migration to remote work. The programme delivered new tools, services and projects designed to help organisations maintain security while operating from home.
What Happened
ACD expanded its threat‑intel sharing platform, increased the availability of secure remote‑access solutions, and launched targeted training for remote‑work security. The initiative also coordinated incident‑response exercises across public and private sectors.
Impact
Over 10,000 organisations accessed ACD services, reducing the time to detect and contain remote‑work‑related incidents by an estimated 30%. The programme’s guidance helped mitigate phishing, credential‑stealing, and ransomware attacks that surged during the lockdown.
What to Do
- Integrate ACD threat‑intel feeds into your SIEM or SOAR platform to receive real‑time alerts on emerging threats.
- Deploy the NCSC‑approved secure remote‑access solutions, ensuring MFA and least‑privilege access for all remote users.
- Participate in ACD incident‑response exercises to test your team’s readiness for remote‑work scenarios.
- Review the ACD training modules on phishing and credential‑management and roll them out to staff.
“By adopting ACD’s remote‑work security stack, organisations can maintain operational continuity while reducing exposure to new attack vectors.” – NCSC Advisory
Related articles
NCSC Active Cyber Defence Year 5: Scaling Automated Protections Against Commodity Attacks
The NCSC's fifth annual Active Cyber Defence (ACD) report highlights the program's role in mitigating commodity cyber threats through automated services. Key focus areas include large-scale malicious site takedowns, protective DNS for public sector entities, and vulnerability scanning for internet-facing infrastructure.
Read briefing
Elastic Security Labs Releases LLM Safety Assessment Report
Elastic Security Labs has published a new LLM safety assessment report that outlines practical threats to large language models and offers guidance for defenders. The report focuses on data mapping, normalization, and detection strategy for AI‑driven threats. SecOps teams should review the findings and start implementing the recommended detection steps.
Read briefing
Maintaining Operational Resilience and IT Security During Reduced Staffing Periods
Reduced IT and security headcount during holidays or off-peak periods significantly increases operational risk. Defenders must adjust change management policies, prioritize critical alerts, and enforce strict monitoring to maintain resilience against active cyber threats.
Read briefing
Security Culture: The Missing Layer in Cyber Defense
Technology alone cannot stop attacks. A recent Group‑IB report shows that organizations with strong security culture reduce breach risk by up to 70%. SecOps teams should focus on awareness training, behavioral change programs, and embedding security into daily processes. The following briefing outlines concrete steps defenders can take.
Read briefing