More than half a million domains across thousands of UK government organisations are being monitored by a single department as it adapts how it warns and helps bodies from parish councils to the NHS fix security flaws.
Nick Woodcraft: “When you come with a problem, rather than talking about the technology, talk about the outcomes”
Nick Woodcraft, service owner for vulnerability monitoring at the Department of Science, Innovation and Technology (DSIT), framed the department’s challenge in plain language at Infosecurity Europe 2026. He told attendees that the priority is not to make every organisation a cybersecurity specialist, but to make the problem and its consequences intelligible so recipients will act.
“When you come with a problem, rather than talking about the technology, talk about the outcomes,” he said, arguing that translating technical findings into concrete operational impacts produces clearer priorities and follow-through.
DNS vulnerabilities explained: local councils and the simple consequence that matters
Woodcraft used DNS as an illustrative case. He said a local council does not need to know the technical mechanics of a DNS vulnerability; what matters is that they understand the consequence — they may lose access to their website — and therefore prioritise remediation.
“Most of the people we talk to are extremely competent at what they are do, but they are not cybersecurity or vulnerability experts,” Woodcraft said. “But when you explain this is what it is, this is what it means – that you could lose access to your website - they understand and appropriately prioritize it. That’s been important, finding ways to help people understand.”
Technology layers: using SIEM and the NCSC portal to distribute findings
Because DSIT is responsible for securing more than half a million domains across thousands of organisations, Woodcraft said the department cannot be hands‑on with every body. To scale, DSIT has invested in analytical channels and shared repositories.
“We can push everything we get into a SIEM, and they can prioritize it themselves,” Woodcraft explained, describing how automated Security Information and Event Management tooling is used to surface and rank findings. He also said DSIT began pushing its data into the National Cyber Security Centre (NCSC) portal so recipients can find early warnings in a place “where people might expect to find it, they see the data and trust it.”
He added that these online resources and integrations are intended to present information “in ways they can understand.”
Remediation at scale: drip‑feeding issues and committing human time
DSIT’s approach rejects overwhelming organisations with long lists of findings. Woodcraft said the department discovered that delivering a large bundle of issues at once provoked resistance and inaction.
“We quickly found that if you discover 15 issues within an organization and we said that we had found 15 things, it gets their backs ups and it’s too much information,” said Woodcraft. “We started drip feeding stuff instead – we would gradually feed issues and help them fix it. We also have humans who were prepared to spend the time with them with the sole focus to get it fixed.”
The two‑track method uses automated feeds and portals to reach many recipients, while reserving direct human support to follow through on higher‑priority or harder‑to‑resolve items.
Post‑Mythos planning: return to basics — patching and processes
Looking ahead to a “post‑Mythos” world in which new vulnerabilities could appear more rapidly, Woodcraft acknowledged the problem will need to be solved at scale. He emphasised that getting fundamentals right will go a long way toward reducing risk.
“If we know to keep patching, to keep things up to date and to have the right processes in place, we’re not going to be in as much danger,” he said — a succinct restatement of DSIT’s emphasis on operational hygiene as the first line of defence.
What this means for technologists, policymakers, and local councils
- Technologists and security teams: expect DSIT to continue supplying machine‑readable feeds through SIEM channels and the NCSC portal so teams can prioritise and act locally.
- Policymakers and central authorities: DSIT’s scale — responsible for over half a million domains — forces a hybrid model of automated dissemination plus targeted human help rather than universal hands‑on support.
- Local councils and non‑specialist organisations: clear, outcome‑focused messaging (for example, “you could lose access to your website”) is the method DSIT uses to secure prioritisation and compliance without requiring deep technical expertise.
DSIT’s strategy is straightforward and pragmatic: translate technical findings into operational consequences, push data into portals and SIEMs where recipients already look, stage remediation to avoid overload, and preserve human follow‑up for stubborn problems. The central question the department has acknowledged is how to sustain that mix of automation and person‑time as new vulnerabilities emerge faster — an evolution Woodcraft says “will need to be solved.”
