Emergency Communications in a Power Cut: Radios, Alerts and Mast Backup

In a power cut, the most dependable way to stay informed is a battery or wind-up FM radio, which is exactly what the UK government's Be Ready checklist (22 October 2026) recommends. Emergency alerts still reach phones by cell broadcast while local masts have power, but most mast sites carry only limited battery backup, so keep a charged power bank and paper contact list too.

The advice put "wind up radios" into UK search trends this week. This post covers what the government said, how crank radios work, which broadcast and mobile systems keep running when the grid fails, how alerts reach phones, what regulators expect from telecoms backup power, and how alerts are protected against fakes. It ends with a fifteen minute household kit check.

Key takeaways

• The UK's Be Ready campaign, launched by the Cabinet Office on 22 October 2026, asks households to be ready for 3 days of disruption. Its checklist lists an FM radio (battery or wind up), a charged power bank and important phone numbers written on paper under "Communication and information".
• A wind-up radio stores the energy from a hand crank in a rechargeable cell or capacitor. A minute of cranking buys minutes of listening, not hours, so it works best as a top-up for a radio that also takes ordinary batteries.
• FM and DAB radio need no internet and no mains power at the listener's end. BBC Radio 4 long wave ended on 27 June 2026, so long wave is no longer an option in the UK.
• UK Emergency Alerts use cell broadcast on 4G and 5G networks. A mast sends one message to every compatible phone in range. The government does not need your number or location, and alerts never arrive by email.
• Ofcom's February 2025 technical report found that around 20% of UK mast sites have at least one hour of battery backup. Its June 2026 resilience guidance sets about four hours as good practice for new street cabinets and expects mobile operators to manage power risk in proportion to it.
• Researchers showed in 2019 that LTE alert messages are not cryptographically signed on the radio link. Defences sit on several layers: who can send an alert, how the sending system is secured, how networks spot rogue base stations, and whether you can verify an alert on an official site.

What did the UK government's October 2026 preparedness advice actually say?

On 22 October 2026 the Cabinet Office and Security Minister Dan Jarvis published a news story titled "Households encouraged to take small, simple steps to stay prepared in an emergency". It describes the advice as the first stage of a three-year campaign, called Be Ready, to help households prepare for events such as severe weather that "can occasionally affect services including power, water, phones and the internet". The core ask is to be ready for three days of disruption, the same planning horizon used by France, Ireland and the Netherlands, according to the announcement.

The tone is deliberately modest. The release stresses that many steps cost nothing, such as joining the Priority Services Register so that energy and water companies know who needs extra help during an outage. It also notes that the government has published household resilience advice since May 2024; the older Prepare website (prepare.campaign.gov.uk) now redirects to the rebranded Be Ready site at beready.campaign.gov.uk, and "much of the advice has not changed".

The part that sent people searching for wind-up radios is the checklist on the "Be ready for emergencies" page and in the downloadable PDF. Under "Communication and information" it lists two items:

• FM radio (battery / wind up), with the instruction to "write down frequencies of any national or local radio stations you use for news".
• A charged power bank, to charge phones or compatible medical devices.

The same page asks you to write important phone numbers on paper, including 105 to report a power cut in England, Scotland and Wales (03457 643643 in Northern Ireland), emergency contacts, regular medication and the radio frequencies you use. It suggests adding emergency details to your phone's ICE or Medical ID feature, and a reminder every six months to check your kit. The site also says it "will not be updated with live information during an emergency", which is why the advice points to radio and official alerts.

It recommends no brand or type of radio beyond "FM" and "battery / wind up", does not mention DAB or long wave, and encourages people to build up supplies "gradually over time" rather than buying in a hurry.

How does a wind-up radio work?

A wind-up radio is an ordinary small radio receiver with its own generator. The parts are simple, and understanding them explains both the strengths and the limits.

Some early designs used a clockwork spring that drove the generator while it unwound. Most current designs crank into a rechargeable battery, which holds charge for days. Some use a supercapacitor, which charges quickly and survives many more cycles but holds less energy and leaks it faster.

How long does a minute of cranking last?

Manufacturers quote very different figures, and there is no independent standard test, so treat any single number with care. The physics gives a useful sense of scale. The figures below are illustrative assumptions to show the method, not measurements of any product.

Worked example 1: listening time. Suppose steady cranking delivers about 1 watt into the battery after gear, generator and charging losses. One minute of cranking then stores about 60 joules (1 watt for 60 seconds). If the radio draws about 0.2 watts at low volume, those 60 joules last 300 seconds, or roughly five minutes. Double the volume or light the built-in torch and the time drops sharply. Change any assumption and the answer changes in proportion, which is why the honest summary is "minutes of listening per minute of cranking", not hours.

Worked example 2: charging a phone. A typical phone battery holds around 15 watt hours, which is 54,000 joules. At the same 1 watt, refilling it from empty would take about 54,000 seconds, or 15 hours of cranking. Even adding 10% (about 5,400 joules) takes around an hour and a half. The USB socket on a crank radio is useful for an emergency call or a text, not for running a smartphone through a three-day outage. That is why the government checklist lists a charged power bank as a separate item.

The practical conclusions:

1. A radio that also takes standard disposable cells is more useful than one that only cranks, because spare cells store far more energy than your arm delivers in a sitting.
2. The internal rechargeable cell ages, so test the radio when you test the rest of the kit.
3. Small solar panels are slow; they help over a bright day, not on a dark winter evening.
4. Low volume stretches every source of energy.

Which broadcast systems keep working when the grid and the internet fail?

At the listener's end, broadcast radio has two big advantages over everything else in this post. It is one to many, so a single transmitter serves everyone in range at once with no congestion. And the receiver needs no network connection, no account and no mains power, only a battery.

The question that matters is whether the transmitter stays on air. That depends on the broadcaster's own power arrangements and the transmission company that runs the masts. Broadcasters do not publish site by site backup details, so you cannot check this for your area. The practical answer, which the government advice already reflects, is to note more than one station and, where possible, more than one platform.

FM

FM is analogue: each station has its own frequency and a cheap receiver tunes it with no setup. It is the platform the Be Ready checklist names and the one almost every battery and crank radio supports. National and local stations broadcast on FM across most of the UK, though reception varies with terrain and buildings.

DAB

DAB is digital radio. One DAB transmitter carries a "multiplex", several stations sharing one block of spectrum, as the BBC's guide explains. Reception drops off more abruptly at the edge than FM, and DAB sets tend to draw more power. It is a good second platform, not a replacement for writing down FM frequencies.

Long wave: closed in 2026

Long wave used to be the UK's answer to "one transmitter, whole country". BBC Radio 4 broadcast on 198 kHz long wave for decades, and the signal could be heard across the UK and beyond. That ended on 27 June 2026. In a statement quoted by WorldDAB, the BBC said the long wave infrastructure is owned and run by a third party who advised that the platform is "coming to the end of its life", that continuing would need significant investment for a platform used by a very small share of listeners, and that the platform itself would close on 30 June 2026. Radio 4 continues on FM, DAB, television and online. If an older preparedness guide tells you to tune to long wave, it is out of date.

Medium wave and streaming

Medium wave stations still exist in the UK and many crank radios receive them; treat them as a bonus. Streaming is the least reliable option in an outage, because your router goes off with the mains and mobile data depends on the nearest mast.

The US comparison: NOAA Weather Radio

The United States runs a dedicated public warning radio network. NOAA Weather Radio All Hazards broadcasts warnings, watches and forecasts from the nearest National Weather Service office 24 hours a day. The NWS says the network has more than 1,000 transmitters covering all 50 states, coastal waters and US territories, broadcasting on seven VHF frequencies between 162.400 and 162.550 MHz, and that it carries non-weather hazard information alongside the Emergency Alert System. A normal FM radio cannot receive it; you need a receiver with the weather band. Ready.gov's emergency kit list accordingly includes both a "battery-powered or hand crank radio and a NOAA Weather Radio with tone alert". The UK has no equivalent dedicated network, which is one reason the UK advice focuses on ordinary FM stations.

How do public emergency alerts reach phones?

Emergency alerts on phones in the UK, the US, the EU and many other countries use cell broadcast, a feature of mobile networks standardised by 3GPP in TS 23.041, "Technical realization of Cell Broadcast Service (CBS)". The specification dates back to Release 1999 and is still under change control; later releases added the Public Warning System features that alert systems use.

Why cell broadcast is one to many, not SMS

An SMS is addressed to one phone number. Sending a text to a million people means queuing a million individual messages through the network's messaging centre, which competes with everyone else's traffic at exactly the moment the network is busiest. It also means someone needs the list of numbers.

Cell broadcast works differently. The alerting authority hands a message to the operator's cell broadcast centre. The centre tells the base stations covering the target area to broadcast it on a common channel that every phone in those cells listens to. Every compatible phone in range receives the same transmission at the same time. Nobody needs a phone number, there is no per-recipient delivery, and the message does not compete with calls or texts for capacity.

GOV.UK describes the UK system in exactly these terms: "mobile phone masts in the surrounding area will broadcast an alert. Every compatible mobile phone or tablet in range of a mast will receive the alert." It adds that a phone does not need mobile data or wifi, that alerts are free with no sign up or app, and that the government "does not need to know your phone number or location to send you an alert".

UK Emergency Alerts since 2023

The UK service ran local trials in East Suffolk on 25 May 2021 and in Reading on 29 June 2021, according to the past alerts list on GOV.UK. The first national test went to phones in England, Northern Ireland, Scotland and Wales on 23 April 2023, and a second national test followed on 7 September 2025. Every live alert since, mostly red weather warnings, is listed on the past alerts page with its full text.

What the GOV.UK pages say you will experience:

• A loud siren-like sound, even if the phone is set to silent, plus vibration, for about 10 seconds. The phone may read the alert out.
• The alert includes a phone number or a GOV.UK link for more information.
• Alerts are based on your current location, not where you live, and location services do not need to be on.
• Alerts are sent in English, and in Wales they may also be sent in Welsh.
• Only the emergency services and government departments, agencies and public bodies that deal with emergencies send them.

Which devices receive them: iPhones on iOS 14.5 or later and Android phones and tablets on Android 11 or later, on 4G and 5G networks. You will not receive alerts if the device is off, connected to a 2G or 3G network, wifi only or not compatible, and you may not receive them in airplane mode.

GOV.UK adds that alerts "will not replace local news, radio, television or social media"; drivers should stop safely before reading one, or listen to live radio.

US Wireless Emergency Alerts and IPAWS

In the United States, the Warning, Alert and Response Network (WARN) Act of 2008 established Wireless Emergency Alerts (WEA), which became operational in 2012. The FCC says WEA has been used nearly 96,000 times since launch. Authorised national, state and local authorities send alerts through FEMA's Integrated Public Alert and Warning System (IPAWS) to participating carriers, which push them to compatible phones in the target area. The FCC notes that many providers transmit WEA "using a technology that is separate and different from voice calls and SMS text messages", and that WEA does not track recipients' locations.

There are four alert types: National Alerts, Imminent Threat alerts, AMBER Alerts and Public Safety Messages. Subscribers may block all but National Alerts. Since December 2019, carriers must keep overshoot of the target area to a tenth of a mile on phones that support enhanced geotargeting.

IPAWS is wider than phones. FEMA describes it as delivering authenticated alerts through WEA, the Emergency Alert System on radio and television, NOAA Weather Radio and internet services from a single message.

India's National Disaster Management Authority runs SACHET, an alerting platform built on the Common Alerting Protocol, and Indian media reported a nationwide cell broadcast test in May 2026; we could not confirm the details on an NDMA or Department of Telecommunications page.

What happens to mobile and fixed networks in a long power cut?

This is the part of the picture most people have never had to think about. Your phone has a battery, but the mast it talks to and the street cabinet your broadband runs through also need power, and so does your router.

Mobile masts: limited battery backup

Ofcom has spent two years studying mobile network power resilience. Its "Mobile RAN power resilience" technical report, published on 10 February 2025, gives the clearest public picture. Its summary findings:

• Around 20% of UK mast sites have power backup for at least one hour.
• For outages up to about an hour, around two thirds of the population would still be able to make emergency calls. That is partly because a phone making an emergency call will use any available network, not only its own.
• Only about 5% of sites have backup of at least six hours, so the share of people who could make an emergency call falls as an outage gets longer.
• Upgrading networks so that almost everyone could reach the emergency services for up to four hours would cost approximately £1 billion. Keeping full everyday service running for four hours everywhere would cost approximately £4.4 billion.
• Ofgem data indicates that roughly 90% of power outages last between three minutes and three hours.

Abroad, the report notes, Norway requires two hours of backup at cell sites (four in rural areas), Australia took a voluntary 12 hour approach at a limited number of sites, and Switzerland has considered up to 72 hours. The roaming detail matters: if your network's mast fails, a 999 or 112 call can still go through another operator's working mast, but ordinary calls, texts and data cannot.

What Ofcom now expects

On 16 June 2026 Ofcom published an updated version of its Network and Service Resilience Guidance for communications providers. On power backup it says:

• Street cabinets. For new fixed access deployments, Ofcom expects powered equipment in street cabinets to have backup power installed, and considers "approximately four hours" good practice at installation. Its reasoning combines Ofgem outage data (around 93% of outages under four hours and around 90% under three) with the government's Electricity Supply Emergency Code, under which rota disconnections would last a nominal three hours with possible delays of up to an hour.
• Mobile cell sites. Rather than a fixed number of hours, Ofcom expects mobile operators, under their duties in the Electronic Communications (Security Measures) Regulations 2022, to take appropriate and proportionate measures against power outages that might reasonably be expected. That includes ongoing risk assessment and considering communities that are particularly vulnerable to a power failure.
• Larger sites. Aggregation sites serving many customers are expected to survive long outages, likely with permanent on-site generators that can be refuelled while running.
• Core sites. The heart of each network is expected to have battery backup and fuel generators able to survive power loss for at least five days.

Ofcom's statement page adds that it has shared its findings with DSIT, the Department for Science, Innovation and Technology, to support wider policy, and has worked with industry, government and Ofgem on coordination during major incidents. Its 2025 report says direct to device satellite links need more study before they could replace backup at masts.

Landlines: the digital switchover changes the rules

Traditional copper landlines carried their own power from the telephone exchange, which is why a basic corded phone kept working in a power cut. Ofcom's resilience guidance notes that the old network "inherently provided an amount of power backup". Digital landlines, which run over broadband, do not. The phone plugs into a router, and when the mains goes off, so does the router.

Ofcom's 2018 guidance on protecting access to emergency organisations during a power cut at the customer's premises set the baseline that still applies. Providers must have at least one solution that lets customers reach the emergency services for a minimum of one hour during a power cut at home, and must offer it free of charge to customers at risk because they depend on their landline. In practice that is usually a battery backup unit for the router, or a mobile phone for people with no signal problems. The 2026 guidance notes that some providers offer in-home backup that lasts several hours, while warning that real battery life is often shorter because of temperature, battery age and charge level.

Trade press reported in December 2023 that major providers signed a government charter to protect telecare users during the switchover, which industry has been working to complete by early 2027; we could not confirm either on a DSIT page. If you or a relative relies on a landline for telecare or for calling for help, ask your provider directly what backup they offer, how long it lasts, and whether you qualify for it free.

Your own router and phone

A charged power bank keeps a phone going for days if used sparingly. A small uninterruptible power supply can run a router for a few hours, but only helps while the street cabinet still has power. If you want to size one properly, our post on homelab UPS sizing and runtime walks through the arithmetic.

Which channel works when? A comparison

Satellite messaging is covered in more depth in our explainer on how satellite internet works. LoRa mesh networks are community built: small battery radios relay short text messages to each other with no infrastructure, which makes them interesting for hobbyists and local groups, but their reach depends entirely on how many nodes people in your area run.

How are emergency alerts protected against spoofing?

An emergency alert is only useful if people trust it, and it is only safe to trust if it is hard to fake. Integrity has to hold at three points: who is allowed to send an alert, how the sending systems are secured, and how the message travels over the air to phones. Each has a different defence. This section describes them conceptually and defensively; it gives no instructions for creating false alerts.

Origination: who may send

In the UK, GOV.UK states that alerts are sent only by the emergency services and government bodies that deal with emergencies. In the US, FEMA's IPAWS sign up process shows the layers: an alerting authority completes the IS-247 training course, uses compatible software tested in FEMA's test environment, signs a memorandum of agreement that FEMA says "governs interoperability and security", gets permissions for specific alert types and a specific area with state or tribal sign off, and configures its software with a digital certificate. Messages use the Common Alerting Protocol (CAP) and are authenticated at IPAWS-OPEN. The lesson for anyone running alerting: limit who can send, limit what and where, require strong authentication and keep an audit trail.

Sending systems: gateways, encoders and consoles

Alerting software, broadcast encoders and operator consoles are ordinary networked computers with ordinary risks: default passwords, unpatched firmware, exposed management interfaces and third party components with known vulnerabilities. Mistakes also happen without any attacker, such as a test sent as live. Good practice: keep management interfaces off the internet and behind multi-factor authentication, change default credentials, patch on a schedule and track the components inside, separate test and live modes with a second approver for wide area alerts, log every message, and rehearse a correction message.

Over the air: the radio link

The weakest point historically has been the last hop. In LTE, warning messages travel in broadcast system information that phones read before they have authenticated anything about the cell. A paper presented at ACM MobiSys 2019, "This is Your President Speaking: Spoofing Alerts in 4G LTE Networks" by Gyuhong Lee and colleagues at the University of Colorado Boulder (pages 404 to 416 of the proceedings), showed that this broadcast channel carries no signature a phone can check. The practical constraint is important: an attacker would need radio equipment physically near the targets, so this is a local risk, not a way to fake a nationwide alert.

3GPP's security working group studied the problem in TR 33.969, "Study on security aspects of Public Warning System (PWS)", first planned for Release 12 and still under change control. Adding signatures to broadcast alerts is hard because every phone would need trusted keys, verification has to work for visitors roaming from abroad, and a check that fails must never block a genuine life-saving warning.

Until the radio link is signed end to end, defence relies on layers:

• Network side. Operators can monitor for rogue base stations, for example by looking for unknown cell identities or unusual signal reports from phones.
• Phone side. Keeping phones updated matters, because phone and modem software decides how alerts and suspicious cells are handled. Our post on cellular baseband firmware explains the separate operating system inside every phone's modem, and the 5G security architecture post covers what 5G changed about identity protection.
• Verification by the public. This is where you come in. GOV.UK publishes every real alert on its current alerts and past alerts pages, and its Emergency Alerts home page says the service "will never send you emails or ever ask you to provide personal details". An alert that asks for money, a login or personal data is not genuine. If in doubt, check gov.uk/alerts and listen to the radio.

A commoner risk is a scam text or email styled as an alert. Real UK alerts arrive as a cell broadcast with the alert tone, not as an ordinary text with a link, and GOV.UK asks people to report suspicious emails and websites.

Why telecoms backup power is also a security issue

Ofcom's 2026 guidance places power resilience for mobile sites under Regulation 3 of the Electronic Communications (Security Measures) Regulations 2022, which requires networks to be designed to reduce the risk of security compromises. In this framing a power cut is a compromise of availability, whatever its cause. For operators that means batteries are consumables to monitor, generator fuel needs contracts, battery management and monitoring units are networked devices with their own software, and timing sources need backup too; the guidance calls over-reliance on a single timing source a weakness. For a broader view of how grid incidents happen in the first place, see our post on whether a cyberattack can shut down the power grid.

Step by step: a household communications kit check

This is a fifteen minute check. Run it now, then every three months. The Be Ready checklist suggests checking your whole kit every six months; a quarterly check of the communications items is quick and catches flat batteries before you need them.

Step 1. Radio.

1. Find your battery or wind-up FM radio. If it takes disposable cells, fit fresh ones and keep a sealed spare set next to it.
2. If it has a crank, turn it for one minute, then switch on at low volume and note roughly how long it plays. Write the result on a label on the radio. If the time has fallen a lot since last quarter, the internal cell is ageing.
3. Tune in two FM stations you would use for news, one national and one local. Write both frequencies on the label and on your paper contact sheet, as the government checklist suggests.
4. If the radio has DAB, run a station scan once so it is ready.

Step 2. Power bank.

1. Charge it fully and note the date on a piece of tape; stored power banks slowly lose charge.
2. Check you have the right cable for every phone and any medical device.

Step 3. Phone alert settings (iPhone).

1. Open Settings, then Notifications, and scroll to Government Alerts at the bottom.
2. Make sure the alert types are on (Apple says they are on by default).
3. Check the phone runs iOS 14.5 or later, the minimum GOV.UK lists.

Step 4. Phone alert settings (Android).

1. Open Settings and search for "emergency alerts", as GOV.UK suggests, because menu names differ between makers.
2. Make sure severe and extreme alerts are on. Operator tests always have "operator" in the title and need no action.
3. Check the phone runs Android 11 or later.

If you need to keep alerts off for a specific safety reason, for example a concealed phone, GOV.UK's opting out page explains how. For everyone else, it advises keeping them on.

Step 5. Paper contact list.

1. Write down, by hand or on a printout: 105 (or 03457 643643 in Northern Ireland) for power cuts, your energy and water suppliers' numbers, family and neighbours, anyone who needs checking on, GP and pharmacy, your regular medication and doses, and your radio frequencies.
2. Store it with your printed document copies, somewhere you can find in the dark.
3. Add your emergency contacts and medical information to your phone's Medical ID or ICE feature, remembering that anyone holding the phone can see them.

Step 6. Landline and broadband.

1. If nobody relies on telecare, briefly unplug the router and check whether the home phone works. If it does not, you are on a digital landline with no battery backup.
2. If anyone in the house depends on the landline, ask your provider about a battery backup unit and whether you qualify for it free.
3. Check whether you are eligible for the Priority Services Register and sign up at thepsr.co.uk if so.

Step 7. Log it and set the reminder.

Write the date, the crank test result, both FM frequencies and the power bank charge date on the label or a notes file. On macOS or Linux you can keep that log in a plain text file:

# Add a dated reminder line to a local notes file (no installs needed)
echo "$(date +%F) comms kit checked; next check due in 3 months" >> ~/household-kit-log.txt
tail -n 5 ~/household-kit-log.txt

Step 8. Talk to the household.

Tell everyone where the radio, power bank and contact list live, and agree a plan for when phones stop working, such as a meeting point or a neighbour who checks on an older relative in person, as the Be Ready advice suggests.

Common mistakes

1. Relying only on a smartphone. It covers alerts, calls and news until its battery dies or the nearest mast loses power.
2. Never testing the crank radio. Internal cells age; an untested radio may not play at all.
3. Buying a radio that only cranks. Without a slot for standard cells, every minute of listening costs cranking.
4. Expecting the USB port to run a phone. Keep a charged power bank as well.
5. Disabling alerts after a loud test. Severe and extreme alerts are the one channel that reaches you even on silent.
6. Keeping numbers only in the phone. If the phone dies, so does your contact list.
7. Assuming the landline will work. A digital landline goes off with the router unless a backup unit is fitted.
8. Following an out of date guide. Radio 4 long wave no longer exists.

FAQ

Do I need a wind-up radio, or will a battery radio do?

Either works. The government checklist lists "FM radio (battery / wind up)". A battery radio with spare cells gives the longest listening time; a crank adds a backup that never runs out of cells. A radio that does both is the most flexible.

How long does a wind-up radio last per minute of cranking?

Usually minutes, not hours, and it varies widely with the radio, the volume and the age of its internal battery. Test your own radio with a one minute crank and time it, and note the result on the radio.

Will emergency alerts work during a power cut?

Yes, as long as your phone has charge and a nearby 4G or 5G mast still has power. Ofcom's 2025 report found around 20% of UK mast sites have at least one hour of battery backup, so in a long, wide outage coverage shrinks over time. That is why radio is also on the checklist.

Do I need mobile data or wifi to receive an emergency alert?

No. GOV.UK says a phone does not need mobile data or wifi. Alerts are broadcast by masts to every compatible phone in range, and they are free.

Does the government know my number or location when it sends an alert?

No. GOV.UK states that the government does not need your phone number or location to send an alert, and that data about you, your device or your location is not collected or shared.

How can I tell if an emergency alert is real?

Real UK alerts arrive as a cell broadcast with a loud siren-like tone, come from the emergency services or a public body, and are published on GOV.UK's current alerts and past alerts pages. The service never sends emails and never asks for personal details.

Can I still listen to Radio 4 on long wave?

No. BBC Radio 4 long wave ended on 27 June 2026. Radio 4 remains on FM, DAB, television and online.

Will my landline work in a power cut?

A copper landline with a corded phone usually kept working. A digital landline does not unless your router has a battery backup. Ofcom requires providers to offer at least one hour of emergency access, free to customers who depend on their landline.

Where Safeguard fits, honestly

Safeguard does not make radios, run networks, send alerts or secure phones, and your household kit needs no software security platform. The link is upstream: alerting gateways, broadcast playout, network monitoring tools and phone firmware all ship open source components, and the teams that build that software need to know which versions are inside and whether any carry known vulnerabilities. Safeguard helps there with SBOM and dependency scanning of repositories and container images, vulnerability matching, reachability analysis, and policies and gates. It does not test radio links, detect rogue base stations or harden hardware.

Alerting and network monitoring software is rebuilt and redeployed like any other application, and each rebuild pulls its open source dependencies again. Keeping those components on fixed versions is part of keeping the alerting chain trustworthy, though it does nothing for the radio on your shelf.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation categories include dependencies, licenses, security posture and findings, and each one is set separately. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds.

3. Gold Registry: start from components that are already fixed

Gold Registry provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs and a completed license check, with signed build provenance (signed with Safeguard's key and verifiable with cosign, SLSA Build Level 3 as the design target) and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. Ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

These demos show the software side only, for teams that build or run alerting, monitoring or network management software.

The first is a real Safeguard CLI session: asked to fix a lodash CVE, it reads the finding and advisory, asks before any command that changes something, edits package.json, runs the install and tests with your approval, and pushes nothing. The same flow applies to a dependency inside an alerting gateway.

Click through it at your own pace, or open it full screen.

The second is a real Android session: send work to a computer running the CLI and approve a command from the phone with Allow once, Allow for turn or Deny, useful for an on-call engineer away from the desk.

Click through it at your own pace, or open it full screen.

The third connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use, so a team can ask about the components in its software with access limited to approved tools.

Click through it at your own pace, or open it full screen.

To try it on your own code, get the apps at safeguard.sh/download and read the CLI documentation.

Quick check

Sources

• GOV.UK: Households encouraged to take small, simple steps to stay prepared in an emergency (22 October 2026)
• Be Ready (formerly Prepare) campaign home
• Be Ready: Be ready for emergencies and checklist
• Be Ready checklist PDF
• Be Ready: About this website and UK resilience
• GOV.UK Emergency Alerts
• GOV.UK: How emergency alerts work
• GOV.UK: Opting out of emergency alerts
• GOV.UK: Operator tests
• GOV.UK: Past alerts
• Priority Services Register
• 3GPP TS 23.041: Technical realization of Cell Broadcast Service (CBS)
• 3GPP TR 33.969: Study on security aspects of Public Warning System (PWS)
• Ofcom: Statement on Network and Service Resilience Guidance
• Ofcom: Guidance for Communications Providers on Network and Service Resilience (16 June 2026)
• Ofcom: Mobile RAN power resilience technical report and CFI update (10 February 2025)
• Ofcom: Protecting access to emergency organisations when there is a power cut at the customer's premises (2018)
• GOV.UK: Electricity Supply Emergency Code
• WorldDAB: BBC announces closure of Radio 4 on Long Wave
• WorldDAB: Radio 4 broadcasts on Long Wave end on 27 June 2026
• BBC reception help: What is a DAB multiplex
• BBC reception help: Medium wave and long wave installation
• NOAA Weather Radio All Hazards
• Ready.gov: Build a kit
• FCC: Wireless Emergency Alerts (WEA)
• FEMA: Integrated Public Alert and Warning System
• FEMA: How to sign up for IPAWS
• Apple Support: Government, Emergency and Enhanced Safety Alerts on iPhone
• Android: Emergency phone alerts
• University of Colorado Boulder: This is Your President Speaking, Spoofing Alerts in 4G LTE Networks (publication record)
• NDMA SACHET

Last reviewed: 25 October 2026.