The UK’s leading cybersecurity agency has officially launched a new scheme designed to help providers of critical infrastructure to test and improve their cyber resilience.
The National Cyber Security Centre (NCSC) first trailed its Cyber Adversary Simulation (CyAS) scheme at the CYBERUK 2025 conference.
It enables participating organizations to choose from a list of vetted suppliers, who then craft realistic attack plans based on reconnaissance of the client’s IT infrastructure, exposure, and threat landscape.
“Testers adopt an adversarial mindset and use appropriate tools and techniques to achieve agreed objectives, rather than being driven by commercially procured threat intelligence or constrained by documented tactics, techniques and procedures (TTPs),” the NCSC said.
Read more on cyber resilience: NCSC: Observability and Threat Hunting Must Improve
The CyAS scheme is designed to complement other NCSC initiatives including the Cyber Assessment Framework (CAF) and the associated Cyber Resilience Audit (CRA).
It’s hoped that larger organizations, CNI providers, and government bodies in particular use these frameworks to better understand their security posture and resilience.
“By enabling rigorous, realistic end-to-end assessments by the very best adversary simulation experts, CyAS will help organizations build a clearer picture of how they would stand up to genuine cyber-attacks and take action to strengthen their security and resilience,” said NCSC CTO, Ollie Whitehouse.
“Ultimately, stronger resilience across the UK helps prepare the country for crisis by protecting the essential services we all rely on every day from the most pressing threats.”
Building Resilience for the Future
Andrew Costis, engineering manager of the Adversary Research Team at AttackIQ, welcomed the program's potential to help organizations test how well they can keep essential services running during an attack.
“Building each simulation around an organization’s actual exposure should uncover weaknesses that a generic assessment might miss. Looking back, that approach could have exposed gaps in detection or containment before an intrusion became a prolonged outage,” he said.
“The longer-term opportunity is turning those findings into an ongoing practice through adversarial exposure validation.”
Costis explained that teams must repeat attack behaviors after remediating a weakness to check that the fix has worked, and adapt their testing over time as environments change.
“An assured provider gives organisations confidence in the assessment’s quality,” he concluded. “Keeping those lessons current will determine how much resilience the scheme delivers.”
CyAS will initially operate as a Minimum Viable Product (MVP), so that the NCSC can test demand, refine its methodology, and build confidence before moving towards a fuller operating model.
A list of service providers can be found here.