How to set up Police CyberAlarm for free vulnerability scans

What you need before you start

Police CyberAlarm is a free service funded by the Home Office. It has two halves. The Secure Sensor watches firewall logs for suspicious activity and needs a compatible machine. Vulnerability scanning looks at your organisation from the outside, and that is the only half this guide covers. The service's own FAQ confirms you can activate IP Address Scanning and Website URL Scanning without installing a Secure Sensor.

The preparation is short, but one rule matters. Anything you submit must belong to your organisation, or to another Police CyberAlarm member who has authorised you to manage it. You cannot point the scanner at a supplier's or a client's systems on your own say-so.

• Someone authorised to register the organisation. If you used the earlier version of the service, you need to register again on the relaunched platform (the relaunch was announced in June 2026).
• A work email address that can receive messages from the portal.
• The public website addresses you want scanned.
• Any internet-facing IP addresses you want scanned. These are the addresses outside users can reach, such as a firewall, VPN gateway or mail server. Internal ranges such as 192.168.x.x or 10.x.x.x are not reachable from the internet and are not what this service scans.
• The ability to prove you control each website. Ownership of a website must be verified before scanning can start, and the portal supplies the information needed. In practice that usually means access to whoever edits your DNS or website files, which may be a web agency or your IT provider.

Register your organisation

Registration is done through the Member Portal and the FAQ says it takes only a few minutes. Your organisation registers once. You can then add websites and IP addresses for different sites that belong to it, so there is no need to register each office separately.

We have not been able to walk through the live portal, so screen wording may differ slightly from what we describe here. The order of tasks comes from the service's published guidance.

1. Go to cyberalarm.police.uk and select Register / Login. This takes you to the Member Portal at member.cyberalarm.police.uk.
2. Complete the registration with your organisation's details and an email address that will be monitored. If you are an MSP registering on behalf of a customer, remember that each customer must be recorded as its own Police CyberAlarm member. Your MSP users can be authorised to support them afterwards.
3. Finish any email confirmation the portal asks for and sign in. If a colleague or your IT provider will help manage the account, the FAQ says additional authorised users can be added to an organisation, so you do not need to share one login.
4. Once signed in, you should be in the Member Portal and able to choose which protections to activate. If you land anywhere else, stop and re-check you used the portal address above.

Add your website and verify you own it

Scanning will not begin until the portal is satisfied the website is yours. Police CyberAlarm does not publicly document which verification method it uses, and the FAQ says only that the portal provides what you need. Follow the portal's instructions rather than anything we or another guide describes. If the method involves a DNS record or a file on your site, the person who manages those will need to make the change, so it is worth asking them before you start. Expect this to be the slowest part of the whole job if the website belongs to an agency.

1. In the Member Portal, add the website address you want scanned. Use the public address visitors type, and add each distinct public site separately. The FAQ says you can add several eligible websites.
2. Select the Website URL Scanning protection for that site.
3. Read the verification instructions the portal gives you and pass them to whoever controls your DNS or website hosting if that is not you. Ask them to complete the change exactly as shown.
4. Return to the portal and complete the verification. Carry on once the site shows as verified, because scanning cannot start before that.

Add your internet-facing IP addresses

This step is optional but is what turns the service from a website check into a look at your network edge. Before entering anything, make sure the address is really yours.

A typical trap is shared hosting. If your website lives on a host's shared server, the IP address belongs to the hosting company, not to you, so it should not go into your list. Our reading of the 'must belong to the registered organisation' rule is that the website scan is the right tool there. This is our inference rather than something the service spells out, so ask Police CyberAlarm support if you are unsure.

A scan comes from outside your network and may show up in firewall or intrusion-detection logs. If an MSP or security team watches those alerts, tell them first so nobody treats the scan as an attack.

1. Collect the public IP addresses your organisation owns or controls, from your firewall or internet-provider documentation. Leave out anything your supplier owns.
2. In the Member Portal, add each address and select the IP Address Scanning protection.
3. Follow any further prompt the portal gives. The FAQ describes no separate verification step for IP addresses, so whatever the portal asks for is the authority to follow.
4. Check that each address and website you added is listed with its scanning protection active.

Check it is working and read the results

Scans run regularly rather than on demand. Police CyberAlarm describes them as 'regular', and we could not find a published schedule for the relaunched platform. Older material mentions monthly scanning. Do not assume results will appear on the day you set up, and do not keep re-adding sites if nothing arrives in the first few days. Come back after a reasonable interval and check the portal.

What you should see is information about the protections you activated. The service says that for each vulnerability found, a report shows its severity and, where available, relevant CVE information. A CVE is the public identifier for a known security flaw, so you can look it up or hand it to whoever maintains the system.

The scan finds known weaknesses in services visible from the internet. It does not tell you about patch levels on laptops, user permissions or anything not exposed. Remediation remains the member's responsibility, so someone needs to own the report. Start with the highest-severity items on systems that are genuinely reachable from the internet.

• Success looks like this: your websites show as verified, your IP addresses are listed with scanning active, and a report or findings view appears in the portal after a scan has run.
• Nothing to report is a legitimate outcome, but it only means no known issue was matched for the things you registered.

If it does not work

Most problems come down to ownership or authority rather than anything technical.

• Website will not verify: the person who controls DNS or the site files has probably not made the change yet, or it was applied to a different domain or subdomain than the one you added. Compare it with the portal's instructions exactly, then retry once any DNS change has had time to take effect.
• IP address is rejected or you are unsure it counts: confirm the address belongs to your organisation and is not a hosting provider's. If it belongs to another Police CyberAlarm member, they must authorise you to manage it.
• You used the service before and cannot sign in: previous members need to complete registration on the new platform.
• No results: scanning is regular, not instant, and no schedule is published. If weeks pass with verified assets and nothing in the portal, contact the Police CyberAlarm support team through the Member Portal or the contact route on cyberalarm.police.uk.