The UK's National Cyber Security Centre has launched a new Cyber Adversary Simulation (CyAS) scheme to help the country's most critical organisations test their defences against realistic cyber attacks. The scheme, announced on Wednesday 11 November 2026, assures commercial suppliers of adversary simulation services against an NCSC-defined standard, so organisations can identify trusted providers to test their ability to prevent, detect and respond to genuine attacks.

Adversary simulation, sometimes called red teaming, goes beyond traditional penetration testing. Providers first carry out reconnaissance to understand a customer's technology, exposure and threat landscape, then develop realistic, customer-specific attack plans. Testers adopt an adversarial mindset and use appropriate tools and techniques to achieve agreed objectives, rather than being driven by commercially procured threat intelligence or constrained by documented tactics, techniques and procedures.

The scheme is aimed first at the UK's most critical organisations and the bodies that oversee them, including operators of critical national infrastructure and government departments. A full list of assured service providers is published on the scheme's Find a Provider page.

How the scheme fits UK cyber regulation

CyAS complements other NCSC frameworks that support cyber regulation, including the Cyber Assessment Framework (CAF) and the associated Cyber Resilience Audit (CRA) scheme. Together, the NCSC says, these frameworks will help organisations, particularly larger organisations, those operating in critical national infrastructure and government, build a clearer picture of their cyber security and resilience.

The scheme was developed in partnership with Cyber Oversight Bodies, including regulators and Lead Government Departments, to establish a common core standard and a more consistent approach to demonstrating cyber resilience. It also gives those oversight bodies a trusted way to gather evidence of resilience across the sectors they oversee, supporting consistency, shared learning and a stronger understanding of cyber risk.

Launch as a minimum viable product

The scheme will initially operate as a minimum viable product, enabling the NCSC to test demand, refine the methodology and build confidence before moving towards a fuller operating model. The NCSC published guidance and the first scheme documents, including the Scheme Standard and the Working Practices Document, on 17 September 2026, ahead of the formal launch.

Speaking at the launch, the NCSC's Chief Technology Officer Ollie Whitehouse said: "You cannot improve what you do not know. That is why I am delighted to see the launch of the Cyber Adversary Simulation scheme. By enabling rigorous, realistic end to end assessments by the very best adversary simulation experts, CyAS will help organisations build a clearer picture of how they would stand up to genuine cyber attacks and take action to strengthen their security and resilience."

NCSC Deputy Director Chris Ensor added: "Moving beyond traditional pen testing and auditing of controls, the CyAS service enables organisations to practically test their cyber defences, ensuring they are able to protect, detect and respond to cyber attacks."

Why the NCSC is acting now

The launch follows the NCSC's Annual Review 2026, published on 3 November, which warned that AI-powered malware is highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028. In the year to August 2026, the NCSC was notified of 1,831 cyber attacks, of which 337 needed support from its team and 80 were classed as nationally significant.

The NCSC, part of GCHQ, is the UK's National Technical Authority for cyber security, and like all of its Industry Assurance schemes, CyAS draws on that expertise. Organisations considering an engagement should check that their provider is assured under the scheme and confirm the scope, objectives and reporting arrangements before testing begins.

Frequently asked questions

What is adversary simulation? It is a controlled, realistic test of an organisation's ability to prevent, detect and respond to a cyber attack, using reconnaissance and attack plans tailored to that organisation rather than a fixed checklist.

Who is the scheme for? It is aimed at the UK's most critical organisations, including critical national infrastructure operators and government, and the oversight bodies that regulate them.

Sources: National Cyber Security Centre and Cybersecurity Tracker.