NCSC launches adversary simulation assurance scheme

The National Cyber Security Centre has published the scheme documents for its new Cyber Adversary Simulation (CyAS) assurance programme, alongside updated guidance on what organisations should expect from adversary simulation exercises. The scheme is designed to help organisations identify qualified providers capable of delivering realistic, intelligence-led testing that simulates how actual threat actors operate. It sets out clear standards for red team exercises, including scoping, methodology, reporting and ethical conduct, and provides a framework for organisations to assess whether a provider's approach aligns with their risk appetite and operational context.

Why this matters for UK organisations

Adversary simulation, often called red teaming, is one of the most effective ways to test whether existing defences can detect and respond to realistic attack techniques. However, the quality and rigour of red team exercises varies significantly across the market. Some exercises focus narrowly on technical exploitation without testing detection or response capability, while others lack the intelligence-led context that makes testing meaningful. The NCSC's assurance scheme provides a benchmark that helps organisations commission exercises that deliver genuine insight rather than superficial testing. It also clarifies what good adversary simulation looks like, including how exercises should be planned, conducted and reported to support meaningful improvement in detection, response and resilience. For organisations that have never commissioned a red team exercise, or those that have found previous exercises unhelpful, the scheme documents provide a clear starting point for understanding what to expect and how to evaluate providers.

What to review

Organisations commissioning red team exercises should review whether their current or prospective providers align with the NCSC's published standards. The scheme documents provide a clear framework for evaluating provider capability, scoping exercises appropriately and ensuring that testing delivers actionable findings that improve your organisation's ability to prevent, detect and respond to real-world threats. Organisations should also consider whether red team exercises are integrated into broader security assurance programmes, whether findings are acted upon and tracked, and whether exercises are scoped to test the specific threats and attack techniques most relevant to your sector and risk profile. The NCSC guidance also provides helpful context on how adversary simulation differs from penetration testing, and when each approach is most appropriate.

Source: NCSC UK