June 2026 Summaries

In June 2026, the UK Government's Department for Science, Innovation and Technology (DSIT) collaborated with Detectify at Infosecurity Europe to address the complexities of scaling public sector cybersecurity, emphasizing the need for continuous attack surface monitoring across over 500,000 domains and 9,000 internal customers. Faced with challenges similar to those experienced by major enterprises, such as unmapped infrastructure and competing priorities, the UK Government shifted from legacy compliance to a centralized strategy, leveraging Detectify’s capabilities for automated vulnerability monitoring and noise reduction. The implementation of a Vulnerability Monitoring Service (VMS) enabled continuous coverage for 300,000 assets, significantly reducing the median time to resolve critical weaknesses by 84%, while a focus on education and personalized outreach facilitated self-motivation among local entities. By utilizing payload-based assessments to eliminate false positives, the approach ensured taxpayer resources were efficiently allocated, creating a scalable blueprint for enterprise-level application security.

In June 2026, the UK Government's Department for Science, Innovation and Technology (DSIT) addressed the complexities of public sector cybersecurity at Infosecurity Europe, illustrating challenges similar to those faced by large enterprises during cloud expansions and mergers. The UK Government, managing security for over half a million domains, shifted from legacy compliance to continuous attack surface monitoring with Detectify, aiming to tackle rapidly evolving threats characterized by a drastic reduction in the Mean Time to Exploit (MTTE). The strategy centered on centralized procurement and education, allowing local councils to access security intelligence without setup friction, thereby saving taxpayer money and motivating action through understanding rather than mandates. Operationalizing their Vulnerability Monitoring Service (VMS) across 300,000 assets, they reduced exposure times significantly by employing active, payload-based assessments to eliminate false positives and enhance remediation accuracy. Personalized outreach proved more effective than digital integrations, and the initiative set a blueprint for scalable application security, emphasizing high-fidelity scanning and direct security education to minimize alert fatigue and resource wastage.

Attack Surface Monitoring (ASM) and Dynamic Application Security Testing (DAST) are increasingly essential components of modern cybersecurity, necessitating a combined approach to effectively mitigate risks posed by expanding digital infrastructures. As organizations grow their cloud environments, applications, and external services, their attack surfaces widen, making it crucial to identify and secure internet-facing assets that may otherwise go unnoticed or unmanaged. ASM focuses on discovering these assets, such as APIs, cloud resources, and shadow IT, from an external perspective, while DAST simulates real-world attacks to find vulnerabilities within active applications. Traditionally treated as separate functions, the integration of ASM and DAST addresses blind spots by ensuring that newly discovered assets are immediately tested for vulnerabilities, enhancing security posture through automated scan targeting and context-driven prioritization. This unified strategy, exemplified by platforms like Detectify, combines continuous asset discovery with dynamic testing, supported by real-time threat intelligence, to provide comprehensive protection against potential exploits, ultimately enabling organizations to better manage their attack surfaces and prioritize remediation efforts based on real-world risks.