SUVAT publishes a range of reports, guidance documents, and technical advisories to support organisations and individuals in protecting themselves from spam, malware, and other cyber threats. All publications are available to download free of charge.
Reports and reviews
Annual Review 2024–25
A comprehensive review of SUVAT's activities during the 2024–25 financial year, including operational statistics, threat landscape analysis, and financial statements.
Report · 124 pages
Threat Landscape Report 2025
An assessment of the current and emerging cyber threat landscape facing the United Kingdom, with particular focus on spam-delivered malware, ransomware-as-a-service, business email compromise, and AI-generated phishing. This report draws on SUVAT's own data, published reporting from partner organisations, and contributions from industry.
Report · 72 pages
Technical guidance
DMARC Implementation Guide
Step-by-step guidance for organisations seeking to implement Domain-based Message Authentication, Reporting and Conformance (DMARC) to protect their email domains from spoofing. This guide covers SPF, DKIM, and DMARC configuration, common pitfalls, and monitoring recommendations. Produced in collaboration with the National Cyber Security Centre.
Guidance · 34 pages
Ransomware Prevention Guidance
Practical guidance for small and medium-sized enterprises (SMEs) on protecting against ransomware attacks delivered via spam email. Covers backup strategies, email filtering, user awareness training, and incident response planning. This publication complements the NCSC's existing ransomware guidance with SUVAT-specific data on spam-borne delivery vectors.
Guidance · 28 pages
Indicators of Compromise: Commodity Malware Families (Q4 2023)
A machine-readable compilation of indicators of compromise (IOCs) associated with commodity malware families commonly distributed through spam campaigns. Includes file hashes, network indicators, and YARA rules. Published in STIX 2.1 format for integration with security information and event management (SIEM) platforms.
Technical advisory · Machine-readable dataset
Email Security Best Practices for Public Sector Organisations
Guidance tailored to organisations, including public sector bodies, on securing email infrastructure against spam and phishing. Includes recommended configurations for Microsoft 365 and Google Workspace environments, gateway filtering policies, and user reporting mechanisms.
Guidance · 42 pages
Requesting publications in alternative formats
If you require any publication in an alternative format (such as large print, Braille, or easy read), please contact communications@suvat.uk. We will endeavour to respond to requests within 10 working days.