Adversary simulation tests whether an organisation can prevent, detect and respond to realistic attacks. The UK NCSC’s September 17, 2026 guidance helps teams plan exercises around critical business outcomes.
Choose the starting point
Full-spectrum testing begins outside the network, attempting initial access before pursuing agreed objectives. It examines external exposure as well as the defences encountered after entry.
Assumed-breach testing starts with an internal foothold. It concentrates effort on whether an intruder can expand access and reach valuable targets, while leaving initial-access resistance untested.
Define safety and useful evidence
Before testing, agree objectives, scope, timescales and escalation arrangements. Require safety controls in testing tools and explicit permission for additional activity. Afterwards, remove exercise artefacts or document how to remove them.
The report should explain attack paths, missed detection opportunities and recommended improvements. CyAS-assured providers must also map their reports to the Cyber Assessment Framework.
NCSC’s CyAS buyer guidance places these engagements after established monitoring, incident response and foundational controls. Listed providers have been assessed against the scheme standard, but buyers still need procurement due diligence.
For the organisation commissioning the exercise, turn recommendations into assigned work and check the resulting changes. The useful outcome is evidence that supports a security decision.
