UK NCSC launches adversary simulation scheme for critical infrastructure

The UK National Cyber Security Centre launched the Cyber Adversary Simulation (CyAS) scheme on Nov. 11, 2026, to help critical national infrastructure operators test cyber resilience. NCSC serves as the United Kingdom’s National Technical Authority for cybersecurity.…

CyAS creates an assurance framework for commercial adversary simulation providers measured against an NCSC-defined standard. The scheme targets large organizations, critical national infrastructure operators and government bodies that already have security controls and monitoring. Cyber Oversight Bodies, including regulators and lead government departments, developed the scheme.…

Suitable organizations understand their key business functions, have assessed cyber risks, maintain incident response arrangements and want to test resilience against realistic attacks. Organizations still building security foundations should use other assessment activities before undertaking adversary simulation.…

The scheme exceeds traditional penetration testing and compliance audits by testing end-to-end protection, detection and response. Before drawing up tailored attack plans, providers map the client’s technology, exposure and threat landscape. Testers use an adversarial mindset and appropriate tools to meet agreed objectives instead of relying on purchased threat intelligence or fixed procedures. Andrew Costis, engineering manager of the Adversary Research Team at AttackIQ, said, “Building each simulation around an organization’s actual exposure should uncover weaknesses that a generic assessment might miss.”…

The scheme begins as a minimum viable product and should run for about 18 months. The minimum viable product phase lets the NCSC assess demand, refine methodology and build confidence before a fuller operating model. CyAS complements the NCSC’s Cyber Assessment Framework and Cyber Resilience Audit scheme.…

A CyAS engagement helps test prevention, detection and response, find control weaknesses, validate monitoring, improve incident response and support risk and investment decisions. Scheme Partners can encourage use of the scheme, recommend assured providers, require engagements and set sector-specific requirements.…

Ollie Whitehouse, NCSC Chief Technology Officer, said, “You cannot improve what you do not know. That is why I am delighted to see the launch of the [CyAS] scheme.” Chris Ensor, NCSC deputy director, said the service lets organizations practically test cyber defences beyond traditional pen testing and control audits.…

The agency said critical national infrastructure must prepare for ransomware attacks that use AI-powered malware before 2028. The agency assessed it is highly likely that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure between now and 2028. On the NCSC risk scale, highly likely corresponds to roughly 80 to 90 percent odds.…

The NCSC said artificial intelligence does not necessarily introduce new attack methods but accelerates the discovery and exploitation of long-standing weaknesses at a scale never seen before. The agency expects a patch wave as AI uncovers old software flaws and urged organizations to plan for critical security updates….

NCSC Chief Executive Richard Horne said UK military networks face break-in attempts every day. The NCSC estimates cyberattacks cost UK organizations 14.7 billion pounds a year….

The NCSC’s State of the Cyber Nation annual review was published on Nov. 3, 2026, and covers Sept. 1, 2025, to Aug. 31, 2026. During that period the NCSC incident team received 1,831 cyber attack reports, supported 337 and rated 80 as nationally significant. Most successful attacks still rely on familiar methods such as known flaws in internet-facing systems, stolen credentials and social engineering. For large organizations, 88 percent of incidents began through public-facing application exploits, phishing, misuse of valid accounts or remote service exploitation….

The Cyber Security and Resilience Bill, introduced in November 2025, brings data centers, managed service providers and critical suppliers into scope. The bill adds stricter breach reporting requirements and heavy fines for negligence. NCSC Chief Executive Richard Horne called the bill a vital step forward. The bill is currently passing through Parliament.…

The government announced 2.4 billion pounds in subsidies to help micro-, small, and medium-sized businesses attain Cyber Essentials certification. The Autumn Budget 2026 provided nearly two hundred billion pounds for AI-driven government cybersecurity projects….

The NCSC and the culture and digital department plan to build a national Cyber Shield over five years. The National Cyber Shield initiative will receive 60 million pounds to apply AI to national defensive operations. An additional 70 million pounds will fund automated diagnostic tools across critical infrastructure.…

Microsoft reported that China-affiliated hackers have used AI since at least September 2025 to breach cloud environments, sometimes gaining administrative control in under three hours. Hackers remotely controlled commercial refrigeration systems across multiple European countries including the UK, raising temperatures and causing food spoilage.…