The big idea is to assess UK's vulnerability to cyber-attacks and to help the owners of Internet-connected systems understand how they have cocked up.

"These activities cover any internet-accessible system that is hosted within the UK and vulnerabilities that are common or particularly important due to their high impact. The NCSC uses the data we have collected to create an overview of the UK's exposure to vulnerabilities following their disclosure, and track their remediation over time."

NCSC's scans are performed using tools hosted in a dedicated cloud-hosted environment from scanner.scanning.service.ncsc.gov.uk and two IP addresses (18.171.7.246 and 35.177.10.231).

The agency says that all vulnerability probes are tested within its own environment to detect any issues before scanning the UK Internet.

NCSC technical director Ian Levy explained that his team was not "We're not trying to find vulnerabilities in the UK for some other, nefarious purpose. We're beginning with simple scans, and will slowly increase the complexity of the scans, explaining what we're doing (and why we're doing it)."

Data collected from these scans includes any data sent back when connecting to services and web servers, such as the full HTTP responses (including headers). Requests are designed to harvest the minimum amount of info required to check if the scanned asset is affected by a vulnerability.

If any sensitive or personal data is inadvertently collected, the NCSC says it will "take steps to remove the data and prevent it from being captured again in the future."

British organizations can also opt out of having their servers scanned by the government by emailing a list of IP addresses they want to be excluded at .