Skip to main content
CISO Daily
Briefing

NCSC Launches Cyber Adversary Simulation Scheme: What Boards Should Ask Before Buying a Red Team

5 min read
CISO Daily
NCSC Launches Cyber Adversary Simulation Scheme: What Boards Should Ask Before Buying a Red Team

On 11 November 2026 the UK’s National Cyber Security Centre (NCSC) announced a new Cyber Adversary Simulation (CyAS) scheme. None of the three pages we read describes a statutory duty, although regulators acting as Scheme Partners may require CyAS engagements. What it does is give buyers a way to identify testing providers that the NCSC has assessed against its own standard. For boards, the value is a clearer answer to a hard question: if a capable attacker targeted us, how would our people, monitoring and response actually perform?

What the NCSC Announced

The NCSC describes CyAS as a scheme that assures suppliers of cyber adversary simulation services. The aim is to help organisations, in the NCSC’s words, “identify trusted providers” to test their ability to prevent, detect and respond to realistic simulated attacks. It is aimed at the UK’s most critical organisations and at the bodies that oversee them.

Providers are assessed against an NCSC-defined standard, as with other NCSC Industry Assurance schemes. The NCSC says a key feature of the methodology is that providers carry out reconnaissance on the customer’s technology, exposure and threat landscape, then build customer-specific attack plans. Testers are meant to pursue agreed objectives with an adversarial mindset, rather than being driven by commercially procured threat intelligence or constrained by documented tactics, techniques and procedures.

NCSC Deputy Director Chris Ensor described the aim as moving “beyond traditional pen testing and auditing of controls”. NCSC Chief Technology Officer Ollie Whitehouse said at the launch: “You cannot improve what you do not know.”

How It Fits With Regulation

The NCSC says CyAS complements the Cyber Assessment Framework (CAF) and the associated Cyber Resilience Audit (CRA) scheme. Under the CRA scheme, assured providers carry out independent audits on behalf of a Cyber Oversight Body, such as a regulator or lead government department. CyAS was developed in partnership with such bodies to establish a common core standard and a more consistent way of demonstrating resilience.

The scheme page says these bodies, called Scheme Partners, may encourage the scheme, recommend assured providers, require organisations to undertake a CyAS engagement, or define additional sector-specific requirements. The page tells organisations overseen by a Scheme Partner to check whether additional requirements apply. As of 12 November 2026 we found no list of which regulators have adopted the scheme, or whether any currently mandate it, in the three NCSC pages named in References; we did not check any regulator’s own site.

Who the Scheme Is For

The NCSC is explicit that adversary simulation suits organisations that already know their key business services, have assessed their cyber risks, run security controls and monitoring, and have incident response arrangements. It says those still building their foundations may be better served by other assessment or assurance activity first. In our assessment, that is a useful filter for budget conversations: a simulated attack on an immature environment is likely an expensive way to learn what a basic audit would have told you.

Early Days

The NCSC says the scheme will initially operate as a Minimum Viable Product (MVP), so it can test demand, refine the methodology and build confidence before moving to a fuller operating model. The scheme page says it expects this phase to last approximately 18 months and that the scheme may change during it. The announcement points to a “Find a Provider” page listing assured providers. We did not review that list or assess any provider.

Questions for the Board and the CISO

The following are our assessment, not NCSC guidance, and not legal advice.

  1. Is our sector overseer a Scheme Partner? If so, has anyone confirmed whether the regulator encourages, recommends or requires CyAS engagements?
  2. Are we ready to benefit? Do we have the risk assessment, monitoring and incident response arrangements the NCSC says should be in place first?
  3. What objectives would we agree? Simulations pursue agreed objectives. Directors should expect those to map to critical services, not to the easiest systems to test.
  4. What will we do with the findings? Who owns remediation, and will results reach the board and risk committee in plain language?
  5. How does this sit with other testing? Where we also face regimes such as the EU’s Digital Operational Resilience Act (Regulation (EU) 2022/2554), which provides for threat-led penetration testing, who is coordinating scope so the same business services are not tested twice under different rules?
  6. Which providers, and why? Assurance against an NCSC standard is one input. Procurement should still examine independence, handling of live-environment risk and liability terms.

Our Assessment

For executives, the practical shift is that “we commissioned a red team” becomes easier to evidence and compare. An assured provider does not guarantee a good outcome, and an MVP scheme may change. But a board that asks who tested its defences, against what standard, and what changed afterwards is asking the right questions regardless of whether its regulator ever mandates CyAS.

References