The UK’s National Cyber Security Centre has launched a scheme to help organisations assess whether their security arrangements can withstand realistic cyberattacks, introducing a common standard for specialist providers conducting advanced resilience testing.
The National Cyber Security Centre (NCSC) has developed Cyber Adversary Simulation (CyAS) to examine how effectively organisations can prevent, detect, and respond to attacks against their systems and services.
The programme is intended particularly for organisations providing critical services, although businesses can commission assessments independently or under the direction of regulators and other bodies responsible for overseeing cyber resilience.
Unlike assessments focused primarily on identifying individual technical vulnerabilities, adversary simulation tests how an organisation’s defences perform against a sequence of coordinated activities intended to achieve a specified objective.
The approach can reveal weaknesses in the interaction between security systems, employee responsibilities, and incident response procedures that may be less apparent when individual controls are examined separately.
Ollie Whitehouse, chief technology officer at the NCSC, said: “You cannot improve what you do not know.”
The NCSC says the scheme will help organisations develop a clearer understanding of their ability to withstand attacks and identify areas where further investment or changes to security practices may be required.
A more consistent approach to assurance —
CyAS establishes requirements for commercial providers conducting adversary simulation assessments. Providers must demonstrate that they can plan, manage, deliver, and report on engagements using the methodology established by the NCSC.
Rather than following a fixed sequence of known attack techniques, testing specialists are expected to develop approaches suited to each customer’s systems, risks, and agreed objectives.
That allows an assessment to consider how an attacker might exploit weaknesses across different parts of an organisation and whether its security teams would recognise and contain the activity.
The objectives and boundaries of each engagement are established with the customer beforehand. The service is designed for organisations with sufficient security maturity to benefit from detailed testing of their existing defences.
The NCSC has developed the scheme alongside cyber oversight bodies, including regulators and government departments responsible for understanding resilience within their sectors.
These organisations can use assessment findings to obtain more consistent evidence about the effectiveness of security arrangements across the businesses and services they oversee.
For companies purchasing cyber assurance services, the scheme also provides a means of identifying providers assessed against a recognised standard. Buyers remain responsible for carrying out their own commercial and procurement checks.
Chris Ensor, deputy director at the NCSC, said CyAS would enable organisations to test their ability to protect systems, detect threats, and respond to attacks rather than relying exclusively on conventional penetration testing and audits.
The programme has launched as a minimum viable product, allowing the NCSC to refine its methodology and operating arrangements as organisations and providers gain experience with the service.
Its introduction adds another option to the security assurance arrangements used by critical organisations, particularly those seeking evidence that their existing technology, monitoring, and response capabilities will operate effectively during a sophisticated attack.
