TL;DR:

  • NCSC’s Early Warning service is free and alerts you when your IP addresses or domains appear in threat intelligence feeds — every UK business should register
  • NCSC Threat Reports and the CISA Known Exploited Vulnerabilities catalogue are the two most actionable free sources for understanding what’s being actively exploited
  • Threat intelligence is only useful if it changes what you do — the goal is informed patch prioritisation, not reading reports

Threat intelligence sounds like an enterprise concern. The reality is that most threats targeting UK small businesses are not bespoke attacks — they’re automated campaigns scanning the internet for known vulnerabilities, opportunistic credential stuffing using leaked password databases, and phishing waves targeting specific industries. Understanding what those campaigns are and how they work is not hard with free tools.

Start With NCSC Early Warning

The NCSC Early Warning service is a free programme that monitors threat intelligence feeds and alerts you when your internet-facing IP addresses, domains, or email addresses appear in those feeds. This includes malware infections, data breaches, suspicious network activity, and known exploitation attempts.

Registration is at ncsc.gov.uk/early-warning. You verify ownership of your IP ranges and domains, and the NCSC notifies you by email when something concerning appears. It’s passive — you don’t have to actively monitor anything — and it gives you visibility you simply can’t get yourself without paying for commercial threat intel feeds.

This is the single most important free step for any UK business with internet-facing services. Register, verify your assets, and set up alerts to go to someone who will actually read them.

NCSC Weekly Threat Reports and Alerts

The NCSC publishes weekly threat reports summarising what it’s observing across the UK threat landscape. These are readable, non-technical-jargon summaries of active campaigns, vulnerabilities being exploited, and sectors being targeted. They’re not paywalled.

Sign up at ncsc.gov.uk/section/keep-up-to-date/ncsc-news. For a small business owner, the relevant question when reading each report is: does any of this apply to software or services I use? If the report mentions active exploitation of a vulnerability in a product you run, that’s a patching priority.

The NCSC also publishes specific alerts when particularly serious vulnerabilities are being exploited at scale. These are more urgent than the weekly summary and are worth acting on within 24-48 hours if the affected software is in your environment.

CISA Known Exploited Vulnerabilities Catalogue

The US Cybersecurity and Infrastructure Security Agency (CISA) maintains a public catalogue of software vulnerabilities that have confirmed active exploitation in the wild. It’s at cisa.gov/known-exploited-vulnerabilities-catalog and it’s free.

This is the most directly actionable vulnerability intelligence source available. A vulnerability appearing on the KEV list means: attackers are using this right now, not theoretically. The list includes the vendor, product, CVE ID, a brief description, and a remediation deadline for US federal agencies (which you can ignore, but the presence of a deadline signals urgency).

Use it by regularly checking whether any software you use appears on recent KEV additions. Set a calendar reminder to check the list every two weeks. When something you use appears, treat it as a high-priority patch, not a routine update.

Have I Been Pwned and Credential Monitoring

Have I Been Pwned (haveibeenpwned.com) lets you check whether email addresses from your domain have appeared in known data breaches. The Domain Search feature checks all email addresses at a domain at once and requires domain verification — it’s free for businesses.

What this tells you: if staff email addresses appear in breach data, their passwords may be compromised elsewhere. Because people reuse passwords, a breach of an unrelated service may have exposed credentials that work on your systems. Seeing an employee’s email in a breach is a reason to require that person to change their password and enable MFA if they haven’t already.

Spycloud and similar commercial services do this more comprehensively, but Have I Been Pwned covers the major publicly known breaches and is a reasonable free baseline.

AlienVault OTX for Threat Actor Context

AlienVault Open Threat Exchange (otx.alienvault.com) is a community threat intelligence platform where security researchers share indicators of compromise (IOCs): malicious IP addresses, domains, file hashes, and associated threat actor context. It’s free to use.

For most small businesses, the directly useful feature is searching a suspicious IP address or domain name. If you see an unexpected connection in your firewall logs or an email came from an unusual domain, you can check it against OTX to see if it’s been flagged by the community. A match doesn’t confirm malice but is a signal worth investigating.

The platform also publishes “pulses” — curated sets of IOCs around specific threat campaigns or malware families. Following pulses related to threats relevant to your sector gives you a feed of current threat activity.

Shodan: Understanding What You’re Exposing

Shodan (shodan.io) is a search engine for internet-exposed devices and services. It continuously scans the internet and indexes what it finds — open ports, running services, SSL certificates, device types.

Free accounts can search Shodan and look up your own IP addresses to see what Shodan reports as visible from the internet. This gives you a perspective similar to what an attacker scanning for targets would see.

The practical use for a small business: search your business IP addresses (your static IP from your ISP, or the IP range your hosting uses). Check whether anything unexpected is showing as exposed — remote desktop, database ports, administration interfaces. Shodan seeing an RDP port open on your business IP is information worth acting on.

Threat Intel as Decision Support, Not Reading Material

The failure mode with threat intelligence for small businesses is treating it as content to read rather than decisions to make. The value is not understanding the threat landscape in general. It’s changing specific actions.

A useful mental model: when you encounter any piece of threat intelligence, ask “does this affect anything I run, and if so, what do I do about it?” If the answer is no, discard it. If the answer is yes:

  • If it’s a software vulnerability: patch or apply mitigations before the next business day
  • If it’s a threat actor targeting your sector: review whether the described techniques apply to your setup (phishing in a specific format, exploitation of a specific service)
  • If it’s credential breach data affecting your domain: reset those accounts and enable MFA

The NCSC’s Cyber Action Plan (ncsc.gov.uk/cyberaware/actionplan) generates a personalised list of security improvements based on your business size and setup. It’s worth going through because it maps general threat awareness to specific controls. Threat intelligence without controls to back it up is just anxiety.

Putting It Together

For a UK small business, a minimal but effective threat intelligence process looks like this:

  1. Register for NCSC Early Warning — passive monitoring of your assets against threat feeds
  2. Subscribe to NCSC alerts and weekly reports — stay aware of active campaigns and major vulnerabilities
  3. Check CISA KEV every two weeks — verify nothing you run has been added to the exploited vulnerabilities list
  4. Run Have I Been Pwned domain search monthly — catch credential exposures before attackers use them
  5. Check Shodan for your business IPs quarterly — verify your internet exposure matches your expectations

This takes roughly 30 minutes a month once established. It won’t stop sophisticated targeted attacks, but the vast majority of what hits small businesses is not sophisticated or targeted — it’s automated opportunism that basic awareness and prompt patching can deflect.