Active Cyber Defence (ACD) – the fourth year
Summary
The NCSC’s ACD year four report reviews the programme’s work during 2020, under the theme “How can we use it to help…”. It explains how ACD tools and services were adapted to support the rapid shift to home working, to protect the health and retail sectors during the pandemic, and to respond to major supply-chain incidents such as the SolarWinds Orion compromise.
The report emphasises the programme’s aim: to protect most people in the UK from most cyber harm most of the time. It highlights how services (for example Vulnerability Reporting and Protective DNS) feed into one another to improve detection and remediation, and describes the year’s key stories and trends rather than focusing solely on numbers. The full PDF is available for download from the NCSC site.
Key Points
- The report covers ACD activity during 2020 and was published by NCSC on 10 May 2021.
- Theme: “How can we use it to help…” – prioritising support for remote working and critical sectors during the pandemic.
- ACD contributed to the UK response to the SolarWinds Orion supply-chain compromise.
- Services are deliberately joined-up: Vulnerability Reporting Service findings (eg. Dangling DNS) were improved using data from Protective DNS.
- The report moves away from heavy metrics and focuses on case studies and trends to convey impact.
- ACD is a collaborative effort involving public sector, commercial and international partners.
- Downloadable report PDF provided for full detail and technical background.
Why should I read this?
Short version: if you’re responsible for cyber risk, this saves you time. It shows what actually worked at national scale in 2020—from shielding critical services during the pandemic to handling the SolarWinds fallout—and explains how different defensive tools feed each other. Read it for practical examples, evidence of what to adopt, and to spot trends you’ll want to factor into your own security plans.
Context and Relevance
2020 was a turning point: mass remote working increased exposure and highlighted supply-chain risks. The ACD report is important because it documents pragmatic, scalable defences (PDNS, vulnerability reporting, incident support) that other organisations can learn from or integrate with. For cyber security professionals, public sector teams, and organisations of all sizes, the report offers insight into national-level defensive practice and collaboration models that remain relevant as attack surfaces and supply-chain threats evolve.