Ollie Whitehouse

CTO as the UK's National Cyber Security Centre

Former: PortSwigger, InterruptLabs, Group CTO at NCC Group, BlackBerry, Symantec, Atstake etc..

Substack: https://ctoatncsc.substack.com/
Twitter: https://twitter.com/ollieatnowhere
Subreddit: https://www.reddit.com/r/blueteamsec
LinkedIn: https://www.linkedin.com/in/olliewhitehouse/
Company #1:
Company #2:

Last Notes

2026-08-22 10:24:24 UTC

Weekly summary is out...
https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-august-13a

2025-10-15 19:45:40 UTC

Once again all edge network device vendors are asked to read and implement our 'Guidance on digital forensics and protective monitoring specifications for producers of network devices and appliances'
Doing do will enable cyber defenders to know and hunt.
https://www.ncsc.gov.uk/guidance/guidance-on-digital-forensics-protective-monitoring

2025-09-26 18:29:14 UTC

- reply

we refer to this as 'Market Incentives'
https://www.ncsc.gov.uk/collection/ncsc-annual-review-2024/chapter-03/market-incentives
https://www.ncsc.gov.uk/blog-post/market-incentive-the-pursuit-for-resilient-software-hardware
https://www.ncsc.gov.uk/blog-post/sausages-incentives-rewarding-resilient-technology-future
.. we are on it, but will need a little time ..

2025-09-26 17:58:11 UTC

- reply

which is the intent of Share & Defend - to protect those who can't protect themselves.
it's a fair challenge - we are also working on some upstream stuff like passkeys etc.

2025-09-26 17:49:19 UTC

- reply

we have also recently released (last week) a buyers guide for external attack surface management - https://www.ncsc.gov.uk/blog-post/easm-buyers-guide-now-available - d
we also continue to push forward on Share & Defend too etc.
all of which are intended to protect the many and reduce the easy wins.

2025-01-29 14:14:37 UTC

We have released a new NCSC research paper which aims to reduce the presence of 'unforgivable' vulnerabilities - in it we present a method to assess 'forgivable' vs 'unforgivable' vulnerabilities'.
https://www.ncsc.gov.uk/blog-post/eradicating-trivial-vulnerabilities-at-scale

2024-10-15 17:33:38 UTC

- reply

CTO for the UK's National Cyber Security Centre here - if you send me the details happy to use our channels.