The U.K. National Cyber Security Centre (NCSC) launched a Cyber Adversary Simulation (CyAS) scheme to help critical national infrastructure (CNI) operators and other critical organizations assess their ability to withstand realistic cyberattacks. The initiative establishes an assurance framework for commercial providers of cyber adversary simulation services, helping organizations identify trusted suppliers to test their capabilities to prevent, detect and respond to simulated attacks. Providers will be assessed against an NCSC-defined standard, drawing on the agency’s expertise as the U.K.’s National Technical Authority for cybersecurity.
The CyAS methodology requires providers to conduct reconnaissance of an organization’s technology, exposure and threat landscape before developing customer-specific attack plans. Testers will adopt an adversarial approach and use appropriate tools and techniques to achieve agreed objectives, moving beyond traditional penetration testing and security audits to assess end-to-end defensive capabilities.
Developed with Cyber Oversight Bodies, including regulators and Lead Government Departments, the scheme complements the NCSC’s Cyber Assessment Framework and Cyber Resilience Audit scheme. It will initially operate as a minimum viable product (MVP), allowing the NCSC to assess demand, refine its methodology and build confidence before moving toward a fuller operating model. They also give Cyber Oversight Bodies a trusted way to gather evidence of resilience across the sectors they oversee, thereby supporting consistency, shared learning and stronger understanding of cyber risk.
“You cannot improve what you do not know. That is why I am delighted to see the launch of the Cyber Adversary Simulation scheme,” Ollie Whitehouse, NCSC’s Chief Technology Officer, said in a media statement this week. “By enabling rigorous, realistic end-to-end assessments by the very best adversary simulation experts, CyAS will help organizations build a clearer picture of how they would stand up to genuine cyber attacks and take action to strengthen their security and resilience.”
He added, “Ultimately, stronger resilience across the UK helps prepare the country for crisis by protecting the essential services we all rely on every day from the most pressing threats.”
“Moving beyond traditional pen testing and auditing of controls, the CyAS service enables organizations to practically test their cyber defences, ensuring they are able to protect, detect and respond to cyber attacks,” Chris Ensor, NCSC deputy director, observed.
A CyAS engagement can help organizations test their ability to prevent, detect and respond to cyber attacks, identify weaknesses in security controls and processes, validate monitoring and detection capabilities, improve incident response arrangements, and support cyber risk management and investment decisions.
The CyAS scheme is intended for organizations that understand their key business functions and services, have identified and assessed their cyber risks, have established security controls and monitoring capabilities, have incident response arrangements in place, and want to test their resilience against realistic cyber attacks.
Cyber adversary simulation is particularly valuable for large organizations, CNI operators and government organizations. However, any organization with a mature understanding of the cyber risks it faces may benefit from a CyAS engagement. Organizations still developing their cyber security foundations may find other assessment or assurance activities more appropriate before undertaking adversary simulation.
The scheme has been developed with Cyber Oversight Bodies, such as regulators and government departments that have responsibility for understanding and improving cyber resilience within their sectors.
Organizations that use the scheme in their sectors are known as Scheme Partners. A Scheme Partner may encourage organisations to use the scheme, recommend the use of assured providers, require organisations to undertake a CyAS engagement, and define additional sector-specific requirements. They are also regulated or overseen by a Scheme Partner, and those carrying out work for such organizations should check whether any additional requirements apply.
The CyAS scheme is currently operating as an MVP. The MVP phase allows the NCSC to work with buyers, providers and Scheme Partners to evaluate the scheme and identify areas for improvement before wider adoption. During this phase, the NCSC will gather feedback from participants, monitor how the scheme is used in practice, refine guidance, processes and documentation, and improve the assurance model where necessary. The MVP phase is expected to run for approximately 18 months. The scheme may evolve during this period as lessons are learned from early engagements and user feedback.
The CyAS scheme comes as the NCSC warned that CNI should prepare for ransomware attacks involving AI-powered malware by 2028. In its State of the Cyber Nation report, the agency identified that hostile actors are highly likely to increase their use of AI over the next two years to expand the scale and efficiency of cyber operations, including ransomware, social engineering and vulnerability exploitation. The NCSC Annual Review 2026 added that AI does not necessarily introduce new attack methods but speeds up the discovery and exploitation of existing weaknesses at unprecedented scale, and urged organizations to strengthen foundational security, reduce unnecessary internet connectivity and treat Cyber Essentials as a starting point rather than an endpoint.
