The United Kingdom’s foremost cybersecurity agency has officially inaugurated a novel initiative aimed at enhancing the cyber resilience of critical infrastructure providers. This significant development comes through the launch of the Cyber Adversary Simulation (CyAS) scheme, which was initially piloted at the CYBERUK 2025 conference.
The National Cyber Security Centre (NCSC) created the CyAS program to help organizations better prepare for potential cyber threats by simulating realistic cyber-attacks. Participating organizations have the opportunity to select from a carefully vetted list of suppliers. These suppliers are tasked with crafting detailed attack plans, which are informed by a comprehensive reconnaissance of the client’s IT infrastructure, potential vulnerabilities, and the broader threat landscape. The approach allows for a tailored testing environment that mirrors the potential risks specific to each organization, making the assessments more effective.
The NCSC outlined that the individuals conducting these simulations adopt an adversarial mindset, employing appropriate tools and techniques to fulfill agreed-upon objectives. This method stands in contrast to traditional assessments that may rely heavily on commercially procured threat intelligence or strictly defined tactics, techniques, and procedures (TTPs). As a result, the CyAS scheme provides a more realistic and unbounded testing framework that aims to reveal vulnerabilities in a bespoke manner.
The CyAS initiative is not a standalone effort; instead, it complements other NCSC projects, such as the Cyber Assessment Framework (CAF) and the Cyber Resilience Audit (CRA). These frameworks are particularly vital for larger entities, critical national infrastructure (CNI) providers, and governmental bodies, as they facilitate a deeper understanding of their existing security posture and resilience capabilities. As the NCSC’s Chief Technology Officer, Ollie Whitehouse, emphasized, the aim of the CyAS initiative is to empower organizations to better anticipate and prepare for genuine cyber-attacks. “By enabling rigorous, realistic end-to-end assessments by the very best adversary simulation experts, CyAS will help organizations build a clearer picture of how they would stand up to genuine cyber-attacks and take action to strengthen their security and resilience,” he noted.
Whitehouse further articulated the broader implications of the scheme, stating that enhanced resilience throughout the UK is crucial for protecting essential services that citizens rely on daily. The initiative, which focuses on preemptively addressing threats, is expected to contribute significantly to the country’s preparedness in times of crisis.
Andrew Costis, the engineering manager for the Adversary Research Team at AttackIQ, has also praised the program for its potential to assist organizations in testing their operational continuity during cyber aggressions. Costis mentioned that crafting simulations based on an organization’s specific vulnerabilities could uncover weaknesses that standard assessments might overlook. He reflected on the past, indicating that such an approach could have illuminated gaps in detection or containment systems before they escalated into severe disruptions or outages.
Moreover, Costis stressed the importance of ongoing testing and validation, emphasizing that teams must consistently emulate attack behaviors after addressing vulnerabilities. This continuous cycle of testing and remediation ensures that organizations can maintain their defenses as their operational environments evolve.
His conclusion resonated with the NCSC’s goals, emphasizing that providing organizations with a reliable assessment framework instills confidence in the efficacy of the evaluations. “Keeping those lessons current will determine how much resilience the scheme delivers,” Costis stated, underscoring the importance of adaptive practices in cybersecurity.
Initially, the CyAS initiative will operate as a Minimum Viable Product (MVP). This phase aims to allow the NCSC to gauge interest in the program, refine methodologies, and build trust in the system before a more expansive rollout occurs. Organizations interested in participating in the CyAS scheme can find a list of qualified service providers through the NCSC’s official website, paving the way for more secure critical infrastructures across the country.
This new initiative from the NCSC promises to bolster the UK’s cybersecurity defenses dramatically and underscores the ongoing commitment of governmental bodies to ensure the safety and reliability of essential services amid an ever-evolving cybersecurity landscape. As organizations begin to adopt these advanced simulation techniques, they can not only enhance their own resilience but contribute to a collective security effort that protects the public at large.