How SC3 shares confirmed attacker intelligence across Scotland's public sector
The Scottish Government selected Lupovis through its CivTech programme to give the Scottish Cyber Coordination Centre earlier warning of threats to public services. A fully managed service now feeds high-fidelity intelligence into the national MISP instance, with no extra burden on public sector IT teams.
Public sector · Threat-led defence
.png)
Threat-led defence
Get research and insights on the vulnerabilities attackers are exploiting and what they mean for your defences.
Summary
The Scottish Government selected Lupovis through its CivTech programme to give the Scottish Cyber Coordination Centre earlier warning of threats to public services. A fully managed service now feeds high-fidelity intelligence into the national MISP instance, with no extra burden on public sector IT teams.
At a glance
- Selected through: CivTech challenge process
- Deployment: Fully managed and cloud hosted
- Integration: MISP, the Malware Information Sharing Platform
- Year: 2023
Headline results
- One of the largest external data streams into SC3, contributing 2 million indicators a month
- Real-time visibility of active campaigns targeting public services, shared with 100+public sector organisations
- Continuous intelligence into Scotland's MISP platform with no added resource burden on internal teams
The challenge
The Scottish Government set out to strengthen national cyber resilience by improving how threats are detected, understood and shared across the public sector. The aim went beyond stopping ransomware and malware, towards identifying threats before they reached critical systems and coordinating intelligence across agencies.
SC3 plays a central role in national cyber defence and wanted to consolidate threat intelligence so that central government, local authorities, NHS boards and education bodies could act on it quickly. The service had to run without adding complexity or infrastructure to stretched IT teams, and feed directly into MISP in near real time.
The solution
Lupovis runs as a fully managed, cloud hosted service, so public sector teams had nothing to install or maintain. Intelligence from confirmed attacker activity flows automatically into the Scottish Government's MISP instance, where it is enriched and shared across the public sector. It is organised into operational, tactical and strategic layers, and Lupovis reviews the output regularly with SC3.
What changed
SC3 has stronger situational awareness and more to share. Lupovis contributes one of its largest external data streams, giving real-time visibility of the campaigns that are actively targeting public services.
[purple-block-start]
The outcome
Public bodies across Scotland receive intelligence they can act on without having to deploy or manage anything themselves. The work supports the proactive, shared approach set out in Scotland's national cyber strategy.
[purple-block-end]
