The National Cyber Security Centre has launched a new scheme to help critical organisations assess how effectively they can withstand realistic cyber attacks.

The Cyber Adversary Simulation scheme aims to provide assurance of commercial providers offering services that test an organisation’s ability to prevent, detect and respond to simulated attacks. Providers will be assessed against standards set by the NCSC, giving organisations a way to identify specialists whose services meet recognised requirements.

Unlike conventional penetration testing and security audits, the approach involves providers first examining an organisation’s technology, vulnerabilities and potential exposure to threats before developing tailored attack scenarios. This is intended to give organisations a more realistic assessment of how their defences would perform against an attacker, rather than simply checking whether existing security controls meet specified requirements.

The scheme is aimed particularly at larger organisations, critical national infrastructure operators and government bodies, and has been developed with regulators and government departments to establish a consistent approach to testing and demonstrating cyber resilience.

The NCSC said CyAS would initially operate as a minimum viable product, allowing it to assess demand, refine the methodology and build confidence before moving towards a fuller operating model. A list of assured service providers is available through the NCSC’s website.

Ollie Whitehouse, chief technology officer at the NCSC, said: “You cannot improve what you do not know. By enabling rigorous, realistic end to end assessments by the very best adversary simulation experts, CyAS will help organisations build a clearer picture of how they would stand up to genuine cyber attacks and take action to strengthen their security and resilience.”

---