How can NHS organisations respond faster to high-severity cyber alerts?
When a high-severity cyber alert lands, the hardest part isn’t reading it.
It’s answering one question quickly and with evidence:
Are we affected, and where?
For NHS organisations, answering that question means connecting vulnerability intelligence with an accurate view of the technology estate, identifying affected assets and giving security teams the evidence they need to make an informed response.
We’ve explored how that process could be automated using FortiAnalyzer and FortiClient EMS, helping turn an NHS cyber alert into a clearer view of affected endpoints and the action required.
What are NHS England’s seven foundational cyber security outcomes?
In June 2026, NHS England wrote to NHS trust and integrated care board leaders asking boards and executives to assure themselves that cybersecurity risks are being managed effectively.
The guidance identifies seven foundational outcomes with the greatest impact on organisational cyber resilience:
- Asset management
- Supply chain
- Identity, authentication and access control
- Vulnerability management
- Backups
- Security monitoring
- Incident response
For organisations responding to cyber alerts, vulnerability management, asset management, security monitoring and incident response are particularly relevant and they are closely connected.
Knowing that a vulnerability exists is only part of the picture. Security teams also need to understand whether it exists within their environment, where it exists and what needs to happen next.
Why is vulnerability management so important for NHS cyber resilience?
NHS England’s guidance describes vulnerability management as a documented process covering identification, prioritisation, remediation or mitigation, and verification, with evidence retained.
A high-severity cyber alert puts that process into practice.
The organisation needs to move quickly from:
A vulnerability has been identified
to:
This vulnerability affects these devices
and ultimately:
This is what we’re doing about it.
The problem is that establishing what’s affected can become a manual investigation spread across multiple tools, teams and data sources.
That’s where automation can make a difference.
Can NHS cyber alerts be automatically correlated with affected assets?
Yes. Where vulnerability and asset information is available, parts of the investigation process can be automated to help identify whether a CVE associated with an alert exists across the managed estate.
In a Switchshop lab environment, we’ve built a workflow using FortiAnalyzer and FortiClient EMS to explore how that could work.
1. Ingest
FortiAnalyzer checks the NHS England Cyber Alerts feed and processes the CVEs associated with an alert.
This reduces reliance on somebody manually identifying and transferring vulnerability information before investigation can begin.
2. Correlate
Those CVE identifiers are checked against vulnerability data held within FortiClient EMS.
Rather than relying on an alert title or description, the workflow looks for the specific vulnerability identifier across managed endpoints.
3. Identify
Where a match is found, the security team can move from a generic cyber alert to specific information about the affected endpoint.
The incident can include details such as:
- device
- IP address
- logged-in user
- vulnerability finding
- supporting evidence
A no-match can be recorded too. That distinction matters because evidence that an organisation checked and found no affected assets can be just as important as recording a positive finding.
4. Respond
Once affected assets have been identified, the security team has a much more targeted starting point for its response.
Patching can be prioritised, while controls such as IPS may provide mitigation while remediation takes place.
The technology isn’t making the final risk decision.
It’s giving the analyst better information on which to make it.
How does this support NHS England’s foundational cyber security outcomes?
The use case isn’t intended to address all seven foundational outcomes equally.
Its strongest contribution is to vulnerability management, with supporting capabilities across asset management, security monitoring and incident response.
What does this mean for DSPT and CAF 4.0?
The Data Security and Protection Toolkit (DSPT) is aligned with the NCSC Cyber Assessment Framework, and NHS England’s guidance says the DSPT is being updated to incorporate CAF 4.0.
That puts greater emphasis not simply on having security controls, but on being able to provide evidence around how cyber risks are being managed.
An automated cyber alert workflow can help create a clearer record of:
- which alert was investigated
- which vulnerability was checked
- which assets were queried
- whether affected endpoints were identified
- what evidence supported that finding
- what happened next
This doesn’t replace NHS England’s Respond service or the organisation’s responsibility for acknowledgement, decision-making and reporting.
It supports the technical investigation and evidence behind those decisions.
Frequently Asked Questions
What is an NHS cyber alert?
NHS cyber alerts provide health and care organisations with information about cyber security threats and vulnerabilities that may require investigation or action.
What are NHS England’s seven foundational cyber security outcomes?
The seven outcomes are asset management, supply chain, identity, authentication and access control, vulnerability management, backups, security monitoring and incident response.
How can automation improve NHS cyber alert response?
Automation can help correlate vulnerability identifiers, such as CVEs, against information already held about an organisation’s technology estate. This can reduce the manual work required to determine which assets may be affected and give analysts a clearer starting point for response.
How can FortiAnalyzer help with NHS cyber alerts?
In the Switchshop lab use case, FortiAnalyzer is used to process NHS cyber alert information and correlate CVEs with endpoint vulnerability information from FortiClient EMS. The aim is to move more quickly from a general vulnerability notification to identifying specific affected assets.
How does FortiClient EMS support vulnerability management?
FortiClient EMS provides endpoint and vulnerability information that can be used to establish whether managed endpoints are associated with vulnerabilities referenced in an alert.
Does this replace the NHS Respond service?
No. The workflow supports technical investigation and evidence gathering. NHS acknowledgement, decision-making and reporting requirements remain with the organisation.
