Every year, Hexiosec scans every .ac.uk domain, across higher education, further education and research institutions, to build the national picture of risk that Jisc shares with the sector. The scan matters less for what it says about any one institution than for what it shows about all of them together: the same weaknesses turn up across different estates, and the sector is better placed to deal with them together than one institution at a time.
Hexiosec scans every .ac.uk domain once a year, from the outside, mapping each domain, subdomain, exposed service and certificate it can find. Jisc presents the results at its annual conference and shares them with its community. The scan covers higher education, further education and research institutions, and it is a snapshot of where the sector stood when it ran, repeated a year later, not a live feed.
Institutions look very different from the inside, but from the outside their estates are more alike than they appear. They run many of the same platforms, buy from many of the same suppliers, connect to the same national infrastructure and are organised in similar ways: autonomous departments, long-running research projects, student-facing services, and legacy systems alongside new ones.
When a weakness comes from a widely used product, a common configuration habit or a shared supplier, it isn’t one institution’s problem. It appears in many places at once, and each institution is likely to find it, and fix it, on its own.
Seeing the whole sector at once changes what is possible. Six things follow from it.
A shared picture, not hundreds of separate ones. A consistent scan of every .ac.uk domain creates a common reference point for the sector. It shows where challenges are widespread, where they are concentrated, and where individual institutions are performing differently from the sector as a whole: insight that is difficult to build from separate, institution-by-institution assessments.
Fixes found once can serve many. When an issue comes from something many institutions share, the first to resolve it has done most of the work for everyone else. A half-page write-up (what the issue was, how it was confirmed, what changed, how long it took, what to check afterwards) turns every later diagnosis into a checklist. Without a habit of sharing, each team works it out from scratch.
Help reaches the teams who need it most. Jisc’s cyber threat report found that 92% of higher education providers have dedicated cyber security staff, against 37% of further education colleges.[1] Smaller teams have the least time to diagnose an issue from first principles, so a proven, ready-made list of recommendations is worth the most to them. Because the scan covers colleges and research institutions as well as universities, the picture includes the places where capacity is thinnest.
Effort goes where it counts. Knowing which issues are widespread tells the sector where to concentrate guidance, training and shared effort: apply solutions to the common things once and well, instead of every institution working through its own long list in its own order.
A stronger case for investment. A security lead asking leadership for time or budget is better placed with sector-wide evidence than with one institution’s numbers alone. A picture presented by Jisc to the whole community gives IT teams evidence that carries more weight than an internal view.
Direction of travel, not just position. Because the scan is repeated every year, the sector can see whether things are improving, and whether the issues that were widespread last year still are. One snapshot shows where you stand; a series shows where you are heading.
The national picture has already led somewhere concrete. The Chest agreement for Hexiosec ASM and Hexiosec Transfer was developed following the National Picture of Risk research project for .ac.uk, so institutions that want continuous visibility have a collectively negotiated way to get it.[2]
The channels for sharing already exist. What tends to be missing is the habit of using them.
As an annual, outside-in snapshot, the national picture can’t show what changed in your estate last month, or why something is exposed. Keeping your own view current between snapshots is a separate job, and for Jisc members it is one that continuous monitoring tools, including Hexiosec ASM through Chest, are designed for.
The value of scanning every .ac.uk domain isn’t in ranking institutions. It’s in what the sector can do once it sees itself as a whole: share what it finds, share recommendations to solve common problems once, and focus its limited effort where it will matter most. A fix found once can serve many, if it is shared.
That is the idea behind Jisc’s theme for this year’s Security Conference, collaborative people and processes, and it is why we would rather you came to the stand with a fix worth sharing than with a sales question. We’ll be there on 24-25 November, with the national picture and a live scan of your own domain if you’d like one.
What is the National Picture of Risk for ac.uk? It is an annual scan of every .ac.uk domain, covering higher education, further education and research institutions, run by Hexiosec to build a picture of the sector’s external attack surface. Jisc presents key findings within the community.
Is the national scan continuous? No. The national picture is a once-a-year snapshot of where the sector stood when the scan ran, repeated annually, rather than a continuously updated feed. Keeping an individual institution’s view current between snapshots needs separate, ongoing monitoring.
Why do the same vulnerabilities appear across so many institutions? Institutions tend to run many of the same platforms, buy from many of the same suppliers and share similar structures, such as autonomous departments and long-running research projects. A weakness that comes from a common product, configuration habit or supplier therefore tends to appear in many estates at once.
What does the national picture mean for the sector? It gives the sector a shared baseline and a year-on-year view of whether things are improving. It shows which issues are widespread, so effort and guidance can go where they matter most, and it lets institutions share findings and recommendations instead of each diagnosing the same problem alone, which helps smaller teams, particularly in further education, the most. It also gives security leads sector-wide evidence to support the case for investment.
See the national picture in person: we’ll be at the Jisc Security Conference, Manchester Central, 24-25 November. Bring a recommendation you’d be willing to share, or a domain you’d like scanned. Book a stand slot or start a free scan
Part 3 of a five-part series on securing UK education’s digital estate, alongside the Jisc Security Conference. Previous: Securing the academic perimeter. Next: once you know what’s exposed, encrypted transfer and data regulations and the compliance roadmap cover the other half of the picture: moving sensitive data off that estate securely.
Scan your domain to get an instant, no-registration snapshot of your internet-facing assets.
Scan my domain
Send files, collect with forms, and collaborate in spaces - all with zero-knowledge encryption and UK hosting.
Try free