What happened
On September 17, 2026, the UK National Cyber Security Centre published the scheme documents for its Cyber Adversary Simulation (CyAS) assurance scheme, articulating NCSC's view of 'good' cyber adversary simulation (red-teaming/pen-testing style engagements) and the standard assured providers must meet to deliver it. NCSC describes the released documents as a 'minimum viable product' ahead of the scheme's formal launch in November 2026, when buyers will be able to select providers assured against the CyAS standard.
Why it matters
This establishes a formal UK national assurance standard for adversary simulation providers — a discipline increasingly used to test AI/agentic systems as well as traditional infrastructure — giving buyers of red-team services a recognized bar for provider quality ahead of a November 2026 scheme launch.
Action needed
Organizations procuring adversary simulation/red-team services (including AI red-teaming) should review the CyAS scheme documents now and factor NCSC assurance status into vendor selection ahead of the November 2026 launch; providers should assess readiness against the published standard.