"Testers adopt an adversarial mindset and use appropriate tools and techniques to achieve agreed objectives, rather than being driven by commercially procured threat intelligence or constrained by documented tactics, techniques and procedures (TTPs)," the National Cyber Security Centre said as it launched a new Cyber Adversary Simulation programme designed to help operators of critical infrastructure sharpen their defences.
What CyAS offers to organisations that run critical services
The NCSC’s Cyber Adversary Simulation (CyAS) scheme lets participating organisations select from a list of vetted suppliers who will design realistic attack plans tailored to the customer’s actual IT infrastructure, exposure and threat landscape. Suppliers carry out reconnaissance of the client environment and then simulate adversary activity to test detection, response and resilience. The programme was first trailed at the CYBERUK 2025 conference and has now been formally launched by the NCSC.
How the simulations differ from standard assessments
The NCSC emphasises that CyAS testers adopt an explicitly adversarial mindset and are not meant to be constrained by commercially procured threat feeds or by pre‑written lists of TTPs. That distinction is central to the programme: service providers are expected to pursue agreed objectives using appropriate tools and techniques, modelling how a determined attacker might operate end to end rather than following a scripted checklist.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHow CyAS sits alongside the Cyber Assessment Framework and Cyber Resilience Audit
CyAS is designed to complement the NCSC’s existing instruments — the Cyber Assessment Framework (CAF) and the associated Cyber Resilience Audit (CRA). The NCSC said those frameworks, together with adversary simulation, are intended to give larger organisations, critical national infrastructure (CNI) providers and government bodies a clearer picture of their security posture and their ability to keep essential services running under attack.
Ollie Whitehouse, the NCSC’s chief technology officer, framed the ambition succinctly: "By enabling rigorous, realistic end-to-end assessments by the very best adversary simulation experts, CyAS will help organizations build a clearer picture of how they would stand up to genuine cyber-attacks and take action to strengthen their security and resilience." He added that "ultimately, stronger resilience across the UK helps prepare the country for crisis by protecting the essential services we all rely on every day from the most pressing threats."
NCSC will run CyAS first as a Minimum Viable Product
The programme will initially operate as a Minimum Viable Product (MVP). According to the announcement, that approach will let the NCSC test demand, refine its methodology and build confidence in the model before moving towards a fuller operating arrangement. The MVP phase therefore acts as both a practical testbed for suppliers and a governance step for the NCSC as it evaluates how CyAS functions in live environments.
What this means for CNI providers, government bodies, and larger organisations
- CNI providers and larger organisations: the scheme offers tailored, end‑to‑end adversary simulation that should highlight operational gaps a generic assessment might miss; organisations will choose from vetted suppliers to carry out those tests and then act on findings.
- Security teams and engineers: as Andrew Costis, engineering manager of the Adversary Research Team at AttackIQ, noted, teams must repeat attack behaviours after remediating a weakness to verify that the fix has worked and must adapt testing as environments change. He described the long‑term opportunity as turning simulation findings into "an ongoing practice through adversarial exposure validation."
- Procurement and assurance leads: Costis also stressed that "an assured provider gives organisations confidence in the assessment’s quality," signalling that assurance and supplier vetting are central to uptake and trust in CyAS results.
Andrew Costis welcomed the programme’s potential to reveal weaknesses that a generic test might miss and to measure how well essential services could be kept running during an attack. He warned that the longer‑term value depends on keeping tests current: "Keeping those lessons current will determine how much resilience the scheme delivers."
For organisations considering CyAS, the immediate practical steps are clear in the announcement: select a vetted supplier from the published list, expect reconnaissance and tailored simulated attacks, remediate based on findings, and repeat key behaviours to validate fixes. The NCSC’s MVP design signals an incremental rollout — a deliberate pause to refine the playbook before scaling up — while the stated aim is to fold adversary simulation into the UK’s broader suite of resilience tools.
Original story: https://www.infosecurity-magazine.com/news/ncsc-cyber-adversary-testing-boost/
