Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The UK government says its Vulnerability Monitoring Service (VMS) cut the median time to fix domain-related vulnerabilities from 50 days to 8 days—an 84% reduction. That measures remediation time after an organisation is alerted, not the time to recover from a cyberattack or an 84% fall in attacks. The figures were announced by the Department for Science, Innovation and Technology (DSIT) and the National Cyber Security Centre (NCSC) on 26 February 2026.
What the 84% figure measures
The government’s headline refers to the median time to fix domain-related vulnerabilities: 50 days before the reported improvement and 8 days afterward. A median is the midpoint of the measured remediation times; it is not a promise that every issue is fixed within eight days. The release does not provide the underlying dataset, cohort definition, confidence intervals or calculation notes, so the result should be read as a government-reported outcome rather than an independently audited finding or proof that the service alone caused the change. DSIT and NCSC announcement, 26 February 2026.
The wording “cyber-attack fix times” can sound broader than the measure. The reported figure concerns fixing vulnerabilities before they are exploited, not containing an active incident, restoring systems after an attack or reducing the number of attacks.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat the Vulnerability Monitoring Service does
According to the announcement, the VMS continuously scans internet-facing assets associated with 6,000 UK public-sector bodies. It detects around 1,000 types of cyber vulnerability, sends organisations actionable guidance and tracks issues through resolution. DSIT says the service uses commercial and proprietary scanning tools.
#1 Best Overall
One focus is domain-related weaknesses. The Domain Name System (DNS) translates website names into the network addresses computers use. A weakness in domain or DNS configuration can create opportunities for attackers to redirect users to fraudulent sites, steal data or disrupt services. Identifying and fixing such weaknesses is therefore a preventative security measure, not a substitute for responding to an intrusion that has already happened.
Other results reported by the government
The same release gives several additional figures. Each is a government-reported result; the release does not include the underlying data needed to independently assess how the figures were calculated.
| Measure | Reported result | What it describes |
|---|---|---|
| Median time to fix domain-related vulnerabilities | 50 days to 8 days (84% reduction) | Remediation time, not attack recovery time |
| Median time to fix other cyber vulnerabilities | 53 days to 32 days | Remediation time for vulnerabilities outside the domain-related measure |
| Backlog of critical open domain-related vulnerabilities | 75% reduction | Change in the reported backlog |
| Confirmed vulnerabilities processed and resolved | About 400 per month | Monthly volume reported by the government |
These figures describe different measures: median repair time, backlog size and monthly throughput. They should not be treated as interchangeable indicators of overall cyber risk.
Why scanning is only one part of vulnerability management
A scanner can identify potential weaknesses, but an organisation still needs a process to decide what to fix and confirm that the fix worked. NCSC guidance places scanning within a wider vulnerability-management programme that includes asset discovery, classification, detection, triage, remediation and verification. NCSC guidance: Vulnerability scanning tools and services.
- Discover and classify assets: maintain a view of systems and internet-facing services that need protection.
- Detect and triage: assess findings, confirm what applies and prioritise issues according to their severity and the organisation’s exposure.
- Remediate: apply a suitable fix or mitigation and assign responsibility for doing so.
- Verify: check that the weakness is no longer present and update the organisation’s records.
The government describes the VMS as supporting that workflow by sending guidance and tracking resolution. The announcement does not specify detailed service-level targets or describe how every finding is validated.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Who the service is for—and what the announcement does not establish
The VMS described in the release is a government service for public-sector bodies and their internet-facing assets. Its figures do not establish what a private business, charity or individual would achieve using a commercial scanner. Nor does the announcement compare the VMS with commercial products on coverage, licensing, deployment, integrations or response to newly disclosed vulnerabilities.
Rank #4
NCSC guidance discusses scanning tools and services as options organisations can choose within their own vulnerability-management programmes. The Government Cyber Action Plan also identifies the VMS and NCSC’s Protective DNS as examples of services intended to address cyber risk at scale, while noting barriers to sufficient provision and adoption. Government Cyber Action Plan.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
