The 2025-26 annual cyber threat report from the Australian Signals Directorate (ASD), released in late October 2026, contains a figure more useful to a board than the incident count. The agency notified organisations of potentially malicious activity more than 4,400 times in the last financial year, almost 80% more than the year before, according to The Record. Those notifications helped victims identify 362 incidents, according to SOCRadar's analysis of the report.
The clearest example is an alert sent in May 2026 to 340 organisations about flaws in cPanel, the web hosting control panel. More than 60 incidents were confirmed as a result of that alert.
An external compromise notification is the message in which a national CERT, a researcher or a supplier warns an organisation that an attacker may have got into its systems. It can expose what internal tools have missed. Even so, in many organisations it has no owner and no procedure. It ends up in a shared mailbox or on the phone of someone convinced they are being scammed.
Who spots an intrusion first, the organisation or a third party?
According to Mandiant's M-Trends 2026 report, organisations discovered malicious activity themselves in 52% of investigations in 2025, up from 43% in 2024. In the remaining 48% they heard from someone else, 34% from an external entity and 14% from the attacker, who in that case usually announces itself with a ransom note.
Public agencies' figures give a sense of scale. In its 2025 Annual Review, the UK's NCSC reports that its Early Warning service, with 13,178 organisations signed up, flagged signs of malware or compromise on 131,000 IP addresses to 1,350 organisations. In the United States, CISA had sent 2,131 pre-ransomware notifications in 2024, as of November, under its Pre-Ransomware Notification Initiative, according to Cybersecurity Dive. In Spain, INCIBE handled 122,223 incidents in 2025, 26% more than the year before, according to the annual summary published by España Digital.
M-Trends data help explain why an early warning can matter so much against ransomware. In ransomware cases, the most common initial vector in 2025 was a prior compromise, at 30% of cases, double the previous year. Whoever encrypts the systems often uses access someone else obtained. A notification about a seemingly minor infection, for example a credential-stealing program, can be one of the few chances to break that chain before the access is handed off.
When does the NIS2 clock start if a third party raises the alarm?
The clock starts when the entity, after promptly assessing the warning, reaches a "reasonable degree of certainty" that a significant incident has occurred. The reading comes from guidance by the Centre for Cybersecurity Belgium (CCB), summarised by the law firm CMS. The guidance lists a third party's message among the ways an entity can learn of an incident, whether from a customer, another entity, an authority or the media.
Article 23 of the NIS2 Directive sets the deadlines that run from that point. An early warning is due within 24 hours, a notification within 72 hours and a final report within one month of that notification. On that reading, an organisation that leaves a CERT's email sitting in a shared inbox for three weeks will struggle to tell its supervisor that it was not yet aware of the incident. The Belgian guidance is one national interpretation. The final reference will be whatever each competent authority publishes.
In Spain, the law transposing NIS2 is still pending, and the European Commission referred the country to the Court of Justice of the EU in July 2026, as we explain in our analysis of what changes without national law. Meanwhile other notification duties already apply that an external warning can also trigger. They include those under the GDPR to the supervisory authority (AEPD), Spain's National Security Framework (CCN-CERT), Royal Decree-law 12/2018 for operators of essential services and DORA in the financial sector.
Why do so many organisations ignore an external warning?
Organisations tend to ignore an external compromise warning out of fear of fraud, the thin data it contains, faith in their internal tooling and worry about legal obligations. An NCSC spokesperson told The Record in 2023 that it often struggles to find the right contact, or the person believes they are speaking to a scammer. Criminals do impersonate public agencies, and ASD asks anyone in doubt about a call to ring its official hotline and quote the reference number.
Many notifications contain only an IP address, a timestamp and the name of a malware family. With address translation, cloud services that reassign IPs and logs kept for only a few days, getting from that data point to a specific machine can take hours or prove impossible.
If the EDR has not raised an alert, the notification looks like a false positive, and on top of that comes the less often admitted fear that acknowledging the warning will trigger legal obligations. All of these motives are understandable. Yet they end in the same inaction over a warning that, in some share of cases, was accurate.
What do the data say about the value of external warnings?
The Australian data indicate that external warnings uncover incidents on devices EDR does not cover, although they do not measure how many attacks they prevent. After an Akira ransomware campaign in August 2025 that exploited a SonicWall vulnerability, ASD identified almost 1,000 devices and around 40 Australian organisations as potentially vulnerable, many of them critical infrastructure entities. According to The Record, ASD says attacks declined after it published the alert, although it is not possible to tell how much of the drop was due to it.
cPanel and SonicWall sit on hosting servers and perimeter devices, where there is often no EDR agent deployed or the customer does not even control the server. It is the EDR blind spot on network edge devices, and it is also where an outside observer, able to see exposure from the internet, has the advantage.
ASD does not say how many attacks its warnings prevented or how many recipients acted, and the NCSC acknowledged in 2023 that it does not always know whether its warning arrived in time. The published figures give a ratio of 362 incidents identified from more than 4,400 notifications, roughly one in twelve. It is only indicative. The total combines around 2,200 individual notifications with collective warnings to more than 2,100 entities, such as the cPanel alert.
How should an organisation receive a compromise notification?
An organisation should receive a compromise notification through a published channel, with an owner and a deputy who verify it, turn it into an investigation and document every step.
Where should the warning arrive?
The warning should reach a mailbox published in security.txt, the abuse contact registered in RIPE for the organisation's IP ranges and the contact details held by its reference CSIRT. A security.txt file (RFC 9116) on the main domain covers the independent researcher, and our security.txt scan of large Spanish companies shows how far there is to go.
If the organisation falls under Royal Decree-law 12/2018 or Spain's National Security Framework, its contact details should be up to date with INCIBE-CERT for the private sector or CCN-CERT for the public sector. NIS2 also requires Member States to make entities in scope give their competent authority email addresses, phone numbers and IP ranges (Article 3(4)). In Spain, while the transposition law is pending, having that data ready, and someone to answer at the other end, saves time later.
How can a warning be verified without being dismissed?
A warning is verified without being dismissed by checking it through an independent channel. It means looking up the agency's official number separately, calling it and quoting the notification reference. Links and attachments in the original message stay closed. The procedure should be written down so that whoever takes the call does not have to improvise.
Which records turn an indicator into the affected machine?
Getting from an IP address to the affected machine requires address translation, proxy and firewall logs, a history of public IPs assigned in the cloud and retention covering several weeks. The message usually carries a bare indicator of compromise. Checking today whether that mapping can be rebuilt avoids discovering the gap mid-incident.
Why preserve evidence before cleaning up?
Evidence should be preserved before cleaning up because the next question will be how long the intruder had been inside and what it touched. The temptation is to reinstall the affected machine that same afternoon, but logs, a system snapshot and, where feasible, memory should be captured first. An incident response plan that treats an external warning as a trigger avoids that improvisation, and an incident response retainer brings in specialists without negotiating contracts mid-crisis.
What should be documented about the assessment?
The time of receipt, who assessed the warning, with what data and what they concluded should all be recorded. The record shows due diligence to the supervisor, whether or not the incident turns out to be significant.
Should information go back to the notifier?
Telling the notifier the outcome is advisable, and ASD expressly asks victims to do so. Confirming whether the warning was accurate helps sharpen the next ones. It also feeds the threat intelligence the organisation itself benefits from.
How much does ignoring an accurate warning cost?
Ignoring an accurate warning extends the intruder's dwell time, whose median rose to 14 days in 2025 from 11 the year before, according to M-Trends 2026, and exposes the organisation to penalties. In Australia, the average self-reported cost per cybercrime report reached 141,300 Australian dollars for medium businesses, 45% more than the previous year, according to SOCRadar. For large businesses it was 148,100, down 27%, according to Insurance Business. The figures cover reports of every kind, fraud included, but they give a sense of scale.
NIS2 requires Member States to set maximum fines for essential entities of at least €10 million or 2% of worldwide turnover, whichever is higher. For important entities the threshold is €7 million or 1.4%. Article 20 makes management responsible for overseeing risk management measures, as we discussed in our piece on board accountability under NIS2, and that oversight belongs in a NIS2 compliance programme.
Which decision belongs to the board?
The board has to decide who owns the channel through which an external warning arrives, with what authority to mobilise resources out of hours, and who stands in for them. The cheapest test is to include a fake CERT warning in the next exercise and measure how long it takes to reach someone who can act. If it takes days, the board knows which control is missing.
This analysis is based on public information available on 29 October 2026. The Australian report figures come from outlets that have analysed it (The Record, SOCRadar and Insurance Business), the CISA and INCIBE figures from Cybersecurity Dive and España Digital, and the Mandiant and NCSC figures from their original publications. The reading of the NIS2 deadline rests on the Belgian regulator's guidance and does not constitute legal advice, so each organisation should check it with its competent authority and legal advisers.
Frequently asked questions
Does a CERT warning on its own start the NIS2 24-hour clock?
▾
According to the Belgian regulator's guidance, the warning does not start the clock automatically, but it requires a prompt assessment. The early warning is due once that assessment gives a reasonable degree of certainty that a significant incident has occurred, and leaving the warning unreviewed for days is hard to justify to a supervisor.
How can a genuine warning be told apart from a fraud attempt?
▾
The check should rest on the channel more than on the content. A fraudulent message may quote plausible details, but it does not survive a call to the official number the organisation looks up itself. The phone number or link in the message should never be used, and a genuine agency does not ask for credentials or payment to explain its warning.
What information should be requested from whoever reports a possible compromise?
▾
The notifier should be asked for the affected IP address or domain, timestamps with their time zone, the indicator observed (malware family, connection to a command server or exposed credentials), how the information was obtained, a case reference and a contact for follow-up questions. With less than that, tracing the machine involved takes longer.
Who inside the organisation should receive these warnings?
▾
These warnings should go to a named role with a deputy, reachable out of hours and with authority to trigger incident response without intermediate approvals. It may be the security lead or the SOC, but the designation should be in writing and recorded with the reference CSIRT and, where it exists, the NIS2 competent authority.
Does security.txt help if the organisation is already registered with its national CSIRT?
▾
Publishing security.txt helps because it covers different notifiers. Registration with the national CSIRT handles institutional warnings, while security.txt guides independent researchers, suppliers and other companies that spot a problem and do not know whom to contact.
What if the IP address in the notification has been reassigned?
▾
The first step is to check the assignment history, especially in the cloud, where public IPs are released and reassigned. If the address belonged to the organisation on the date given, the warning still applies. If it did not, the finding should be documented, the notifier told and the case closed with the evidence kept.
Should the notifier be told the outcome of the investigation?
▾
Telling the notifier the outcome is advisable, because confirming whether the warning was accurate, or why it was not, improves the quality of future warnings. In the Australian case, ASD states that it is not a regulator and does not share information it receives without express consent, which eases fears that cooperating will have consequences.
