NCSC Cyber Adversary Simulation (CyAS) scheme launched November 11, 2026
Beyond Pen Testing: NCSC Launches CyAS, an Assured Adversary Simulation Scheme for Critical Organisations
The UK National Cyber Security Centre launched its Cyber Adversary Simulation scheme, CyAS, on November 11, creating an assured tier of commercial providers who run realistic, end-to-end simulated attacks for the country most critical organizations. Under the scheme, providers are assessed against an NCSC-defined standard, and their method is reconnaissance-led: testers study the customer technology, exposure and threat landscape, then develop customer-specific attack plans, adopting an adversarial mindset and using appropriate tools and techniques to reach agreed objectives, rather than being driven by commercially procured threat intelligence or constrained by documented tactics, techniques and procedures. The scheme is designed to test whether an organization can prevent, detect and respond to a realistic attack, and it complements the NCSC Cyber Assessment Framework and the associated Cyber Resilience Audit scheme, giving Cyber Oversight Bodies, including regulators and Lead Government Departments, a trusted way to gather evidence of resilience across their sectors. NCSC Chief Technology Officer Ollie Whitehouse said at the launch: You cannot improve what you do not know, and described rigorous, realistic end-to-end assessments by leading adversary simulation experts as the route to a clearer picture of how an organization would stand up to a genuine attack. Deputy Director Chris Ensor framed the service as moving beyond traditional pen testing and checking of controls toward practically testing defences. CyAS will initially operate as a Minimum Viable Product, so the NCSC can test demand, refine the methodology and build confidence before moving to a fuller operating model, and a list of assured providers is published on the scheme Find a Provider page.
Executives
The signal for boards outside the UK is the direction of travel: a national authority is formalizing adversary simulation as assured evidence, distinct from a control checklist result. If your organization operates UK critical infrastructure or answers to a UK oversight body, expect CyAS-grade evidence to enter resilience conversations, and budget for exercises that test detection and response, not only prevention. For everyone else, the useful question is whether your last exercise was built from reconnaissance of your actual exposure, or from a standard playbook an attacker would not recognize.
CIO / CISO
Note the methodological requirements, because they are the procurement standard: reconnaissance-led planning, objectives agreed in advance, and testers explicitly not constrained by documented technique lists. When commissioning simulation work anywhere, write those properties into the engagement, require findings mapped to your Cyber Assessment Framework or NIST CSF outcomes, and require a retest of remediated weaknesses, since the scheme value lies in findings becoming an ongoing practice rather than a one-time report. Track the provider list as the scheme moves past its initial product stage.
Engineers
Prepare the telemetry before the testers arrive: an exercise only proves detection if the logs exist to be judged. Confirm that authentication events, egress traffic, endpoint detections and cloud control-plane actions are collected centrally, with clocks synchronized, and that the response team knows the escalation path an exercise finding would take. After the exercise, convert every successful attacker path into a detection rule or a configuration change with an owner, and schedule the repeat attempt that proves the fix.
Everyone (non-IT)
If your employer announces a simulated attack exercise, it is a test the organization asked for, run by vetted specialists under agreed objectives. Treat anything you observe during it as you would a real incident: report the suspicious message, call or login prompt through the normal channel, and do not try to investigate it yourself. Realistic tests only teach the right lessons when staff respond the way they would on an ordinary day.