NCSC launches cyber testing scheme to bolster UK resilience

The National Cyber Security Centre (NCSC) has formally launched its Cyber Adversary Simulation (CyAS) scheme to help providers of critical infrastructure test and strengthen their cyber resilience. First trialled at CYBERUK 2025, CyAS lets participating organisations select from vetted suppliers who then design realistic attack plans based on the client’s IT footprint, exposure and threat landscape.

Testers adopt an adversarial mindset and use appropriate tools and techniques to achieve agreed objectives, rather than following scripted threat intelligence or restricted by documented TTPs, the NCSC explained.

The initiative sits alongside the Cyber Assessment Framework (CAF) and the Cyber Resilience Audit (CRA). The NCSC hopes larger organisations, critical national infrastructure (CNI) providers and government bodies will use CyAS to gain a clearer understanding of how they would fare against genuine cyber-attacks and to drive improvements in security and resilience. CyAS will operate initially as a Minimum Viable Product (MVP) to test demand and refine its methodology before expanding to a fuller model.

Andrew Costis of AttackIQ welcomed the approach, emphasising the value of tailoring simulations to an organisation’s actual exposure and the importance of validating fixes through repeated testing. The NCSC’s CTO, Ollie Whitehouse, said CyAS aims to strengthen resilience across the UK to protect essential services. A list of assured CyAS providers is available on the NCSC site.