{"id":3193,"date":"2025-10-11T09:52:28","date_gmt":"2025-10-11T09:52:28","guid":{"rendered":"http:\/\/ft365.org\/index.php\/2025\/10\/11\/ncsc-observability-and-threat-hunting-must-improve\/"},"modified":"2025-10-11T09:52:28","modified_gmt":"2025-10-11T09:52:28","slug":"ncsc-observability-and-threat-hunting-must-improve","status":"publish","type":"post","link":"https:\/\/ft365.org\/index.php\/2025\/10\/11\/ncsc-observability-and-threat-hunting-must-improve\/","title":{"rendered":"NCSC: Observability and Threat Hunting Must Improve"},"content":{"rendered":"
\n

\"Photo<\/p>\n<\/div>\n

\n

UK organizations must improve observability and threat hunting \u201cin the vital pursuit of raising the national ability\u201d to detect cyber threats, the National Cyber Security Centre (NCSC) has urged.<\/p>\n

NCSC CTO, Ollie Whitehouse, argued in a blog post yesterday that there is still \u201csignificant variation\u201d in ability in these areas.<\/p>\n

\u201cObservability and threat hunting are core and interdependent components of modern cyber defense,\u201d he added.<\/p>\n

\u201cMaturing capability across both of these components is essential to strengthening our national cyber resilience.\u201d<\/p>\n

Observability is the foundation for effective threat hunting, because \u201cyou can\u2019t hunt what you can\u2019t see,\u201d he argued. Yet many organizations may not have a comprehensive view into account activity, devices, networks, applications and cloud services. Shadow IT may also complicate these efforts, Whitehouse said.<\/p>\n

Read more on NCSC guidance: NCSC Updates Cyber Assessment Framework to Build UK CNI Resilience<\/em><\/p>\n

Even when organizations do collect data across all of their assets, they often can\u2019t apply advanced analytics to it in order to perform effective threat hunting, he added.<\/p>\n

To address these shortcomings, the NCSC urged security teams to:<\/p>\n