Loading story…
The UK National Cyber Security Centre (NCSC) has published guidance for medium-to-large organisations on using cyber adversary simulation, or red teaming, to measure their ability to prevent, detect, triage, escalate and respond to realistic attacks. Unlike penetration testing, these capability-led exercises use reconnaissance and tailored adversarial approaches to assess technical controls and operational response; they may begin externally as full-spectrum assessments or from an assumed internal breach. Engagements generally run 8–12 weeks, with full-spectrum work potentially lasting around 16 weeks.
The NCSC also released the initial Scheme Standard and Working Practices Document for its assured Cyber Adversary Simulation (CyAS) provider scheme. The documents establish company, personnel, technical-delivery and reporting expectations, with safeguards and cleanup procedures intended to limit risk to customer environments. Intended particularly for mature organisations, critical national infrastructure operators and UK government bodies, the scheme is scheduled to formally launch in November 2026 as a minimum viable product to be refined through feedback and early delivery experience.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
The UK National Cyber Security Centre published guidance on cyber adversary simulation and released the initial Scheme Standard and Working Practices Document for its assured Cyber Adversary Simulation (CyAS) scheme.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The UK National Cyber Security Centre and the Department for Science, Innovation and Technology have outlined **Cyber Shield**, a sovereign cyber defense initiative designed to use agentic AI to find and counter weaknesses across government networks and critical national infrastructure. The program is intended to address rising threats from hostile states, organized crime, and AI-enabled attackers that can accelerate reconnaissance and vulnerability discovery to machine speed, while many organizations still face basic security gaps such as unpatched systems, legacy technology, and weak access controls. Cyber Shield is being designed around federated **red-team** and **blue-team** AI agents that can probe for vulnerabilities, share insights, detect threats, and eventually help automate remediation under the control of infrastructure owners. The NCSC said some building blocks, including automated scanning, already exist, but fully autonomous mitigation will require further research, testing, and oversight. Early work will focus on trials with government and critical-sector defenders, with longer-term goals including national-scale scanning, coordinated blocking of known malicious infrastructure, and commercially scalable capabilities developed with industry, academia, AI providers, and critical infrastructure operators.
Aug 11, 2026
The UK government has published a voluntary **Software Security Code of Practice** aimed at improving the security and resilience of software supplied to businesses and reducing software supply chain risk. Co-designed by the **National Cyber Security Centre (NCSC)** with industry and academic experts, the code sets out **14 principles** across four areas: secure design and development, build environment security, secure deployment and maintenance, and communication with customers. It is primarily targeted at senior leaders in software vendor organizations, who are expected to appoint a **Senior Responsible Owner** to drive implementation and accountability. Alongside the code, the NCSC released **Assurance Principles and Claims** guidance to help vendors self-assess whether they meet a baseline level of software security and resilience. The assessment framework covers controls such as secure development practices, third-party component management, testing, threat modelling, build environment access control, vulnerability disclosure, patching, and customer notification, with evidence drawn from documentation, interviews, and audits. The government said the code has been aligned where possible with international frameworks including the **US Secure Software Development Framework** and the **EU Cyber Resilience Act**, and is being supported with implementation guidance, a self-assessment form, and plans for a future certification scheme.
Aug 1, 2026
The UK government is moving to update the Computer Misuse Act (CMA), originally enacted in 1990, to better protect ethical hacking and legitimate cybersecurity research. The lack of exemptions for researchers in the original law has long been a concern, and recent recognition of the growing scale of cybercrime and the need for robust research has prompted calls for reform. The changes aim to ensure that cybersecurity professionals can conduct research without fear of prosecution, reflecting the evolving threat landscape and the importance of proactive defense. In parallel, the UK's National Cyber Security Centre (NCSC) has highlighted the value and risks of cyber deception technologies such as honeypots and decoy accounts. Findings from the NCSC's Active Cyber Defense 2.0 program indicate that, when properly implemented, these tools can provide valuable threat intelligence and disrupt attacker confidence. However, the NCSC warns that poor implementation can generate noise, create vulnerabilities, or foster a false sense of security, emphasizing the need for clear strategy and ongoing management. The NCSC is working to help organizations invest in and deploy these technologies effectively as part of a modern defense strategy.
Jun 29, 2026