NCSC launches new adversary simulation scheme to bolster UK cyber resilience

The National Cyber Security Centre (NCSC) has launched a new Cyber Adversary Simulation (CyAS) scheme to help the UK’s most critical organisations test their defences against realistic cyber attacks, providing greater assurance of their ability to provide essential services from increasingly sophisticated threats.

Announced on 11 November, the scheme aims to strengthen national cyber resilience by establishing a trusted network of assured commercial providers capable of conducting rigorous, real-world assessments of organisational cyber security.

Designed particularly for organisations operating within the UK’s critical national infrastructure (CNI), government, and other essential sectors, the CyAS scheme will enable organisations to identify weaknesses in their defences and assess how effectively they can prevent, detect, and respond to simulated cyber attacks.

Under the scheme, commercial providers will be assessed against an NCSC-defined standard, giving participating organisations greater confidence that the services they procure meet recognised technical and methodological requirements.

CyAS: Testing cyber defences against real-world attack tactics

A central feature of the CyAS scheme is its emphasis on adversary-led testing – also known as ‘red teaming’ – which goes beyond conventional penetration testing and compliance-based security audits.

Rather than simply identifying technical vulnerabilities, adversary simulation examines how an organisation’s security arrangements perform when confronted with the methods and behaviours of a real-world state or criminal attacker.

Providers undertake reconnaissance to understand an organisation’s technology, exposure, and threat landscape before developing tailored attack plans. This capability-led approach intends to reflect the specific risks facing each organisation, rather than relying solely on commercially sourced threat intelligence or pre-defined attack scenarios.

Testing can examine an organisation’s ability to protect critical systems, identify suspicious activity, respond to potential compromises and maintain essential functions under pressure.

Commenting on the scheme, Ollie Whitehouse – the NCSC’s Chief Technology Officer – said: “You cannot improve what you do not know. That is why I am delighted to see the launch of the [CyAS] scheme.”

He added that CyAS would enable “rigorous, realistic end-to-end assessments” by experienced adversary simulation specialists, helping organisations to understand how they would withstand genuine cyber attacks and take action to improve their security.

“Ultimately, stronger resilience across the UK helps prepare the country for crisis by protecting the essential services we all rely on every day from the most pressing threats,” he said.

Establishing a new benchmark for UK cyber resilience

The NCSC has developed CyAS in partnership with Cyber Oversight Bodies, including regulators and lead government departments, to establish a common standard for demonstrating cyber resilience.

The CyAS scheme is intended to complement existing NCSC frameworks, including the Cyber Assessment Framework (CAF) and the associated Cyber Resilience Audit (CRA) scheme. Together, these initiatives will provide organisations and oversight bodies with a more comprehensive understanding of cyber security performance and resilience across critical sectors.

Chris Ensor, Deputy Director of the NCSC, said: “Moving beyond traditional pen testing and auditing of controls, the CyAS service enables organisations to practically test their cyber defences, ensuring they are able to protect, detect and respond to cyber attacks.”

The NCSC guidance identifies larger organisations and those operating within the UK’s CNI or government sectors as particularly well suited to adversary simulation, especially where established security controls and monitoring capabilities are already in place.

CyAS will initially operate as a Minimum Viable Product (MVP), allowing the NCSC to assess demand, refine its methodology and build confidence before progressing towards a fuller operating model.

Regardless, the launch represents another step towards strengthening the UK’s cyber resilience, helping to ensure that organisations responsible for essential national services can better understand, test and improve their readiness against rapidly evolving cyber threats.