NCSC launches a certification scheme for providers that simulate cyber attacks on critical UK organisations

The UK’s National Cyber Security Centre (NCSC) has put into operation a new certification scheme for companies that simulate cyber attacks, so that the country’s critical organisations can test their defences against realistic scenarios. The programme is called Cyber Adversary Simulation (CyAS) and was presented by the NCSC itself on Wednesday, November 11, 2026.

The essence is simple for anyone buying such services: the NCSC assesses commercial providers against a standard it has set and publishes the list of those that meet it. An organisation therefore does not have to guess which private partner is trustworthy to test how well it can prevent, detect and respond to an attack. CyAS draws on the NCSC’s experience as the UK’s national technical authority for cyber security.

The difference from classic penetration testing (testing a system for known weaknesses) lies in the method. CyAS providers begin with reconnaissance of the target: they study the client’s technology, its points of exposure and the threat environment in which it operates. On that basis they draw up attack plans specific to the organisation. Testers think like adversaries and use suitable tools to achieve the agreed objectives. They are not guided by commercially bought threat intelligence and are not limited to already documented tactics, techniques and procedures (TTPs).

NCSC deputy director Chris Ensor described the programme as a step beyond traditional penetration testing and audits of security measures: “CyAS enables organisations to test their defences in practice, so they are able to protect against, detect and respond to cyber attacks.” NCSC chief technology officer Ollie Whitehouse said at the launch: “You can’t improve what you don’t know.” Realistic assessments by the best experts, he added, will help organisations form a clearer picture of how they would withstand real attacks.

CyAS does not work alone. It complements the Cyber Assessment Framework (CAF), used as a common structure for assessing cyber resilience, and the related Cyber Resilience Audit (CRA) scheme. The CAF is organised around four objectives: managing security risk, protecting against cyber attacks, detecting events and minimising their impact. Cyber security regulators and government departments responsible for each sector are involved as “scheme partners”: they can encourage supervised organisations to use it, recommend certified providers, require a CyAS test or set additional sector-specific requirements.

CyAS is aimed at organisations that have assessed their risks, have security and monitoring measures in place and have an incident response plan. It is particularly valuable for large organisations, operators of critical national infrastructure and government departments, while anyone still hardening basic systems may first need other forms of assessment. The scheme starts as a minimum viable product (MVP), a first, limited form to be tested in practice. The NCSC wants to gauge demand, refine the methodology and build trust before moving to a fuller operating model. This phase is expected to last about 18 months, with feedback from buyers, providers and partners. The list of certified providers is available on the scheme’s “Find a Provider” page.

The NCSC recently called out, with allies, a Chinese company that facilitated hackers stealing sensitive data, as we covered in our report on Integrity Tech.