Key points
- The NCSC is gathering details on how organizations evaluate and purchase external attack surface management solutions.
- This research supports the development of the Advisory Committee on Business and Industry’s ACD 2.0 framework.
- Participants can register via a confidential form hosted by Optimal Workshop to join the research panel.
The short version
- The UK NCSC is seeking input from professionals involved in selecting or adopting external attack surface management tools.
- The agency wants to understand the challenges organizations face during the procurement and evaluation phases.
- This data will help shape better guidance and services for managing external attack surface risk under ACD 2.0.
The details
The UK National Cyber Security Centre (NCSC) is launching a new research initiative focused on how organizations approach external attack surface management (EASM). According to an official advisory published on the NCSC website, the agency is specifically looking to hear from people involved in evaluating, selecting, or adopting EASM solutions. This request follows earlier conversations held earlier this year with organizations that already use exposure management solutions, which provided insights into how they review findings and prioritize risks.
The NCSC states it is now interested in the earlier stages of the security lifecycle. The agency wants to learn about the considerations and decisions organizations face when determining what support, tools, or services best meet their needs. This includes understanding the business cases, supplier selection processes, and strategic leadership decisions that drive these purchases. The NCSC is particularly keen to hear from individuals who influence cyber security investment decisions or manage procurement activities.
Participants in this research may include those who evaluate cyber security tools, contribute to risk management, or provide governance and assurance. The NCSC is interested in experiences from organizations that are considering EASM for the first time, as well as those that have recently selected or implemented a solution. The goal is to understand the full spectrum of challenges, from identifying organizational needs to comparing different approaches in the market.
The context
This research is part of the broader ACD 2.0 project, which aims to update guidance for organizations managing cyber risk. The NCSC notes that sharing experiences will help shape better guidance and services for organizations dealing with external attack surface risk. Participation is entirely voluntary, and the agency assures that all information provided will remain confidential. Interested parties are asked to complete a registration form hosted by Optimal Workshop, which takes no longer than five minutes.
Once registered, individuals are added to a research panel for future activities. The NCSC will contact participants via email if an opportunity arises that fits their experience and current research focus. The advisory encourages readers to share the invitation with colleagues involved in cyber security decision-making, procurement, or risk management. The NCSC emphasizes that this input is crucial for shaping the future of ACD 2.0 services.
What to watch
Organizations should monitor NCSC communications for updates on the ACD 2.0 framework and related guidance. The agency has previously indicated that by 31 March 2026, organizations should have alternatives to Mail Check and Web Check in place. This timeline suggests a broader shift in how the NCSC expects organizations to manage external vulnerabilities and exposure. The new research phase indicates that procurement and tool selection will be key components of upcoming guidance.
What to do and how to stay safe: NCSC
- Review your organization's current process for evaluating and purchasing external attack surface management tools.
- Identify stakeholders involved in cyber security procurement and risk management to see if they qualify for the NCSC research.
- Complete the registration form if you are involved in selecting or adopting EASM solutions to contribute to future guidance.
- Monitor NCSC updates for changes in ACD 2.0 requirements and deadlines for replacing legacy services like Mail Check.
Step-by-step guide: Implement Security Awareness Training Without the Burnout
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who is eligible to participate in the NCSC's EASM research?
People involved in evaluating, selecting, or adopting EASM, as well as those influencing cyber security investment or procurement decisions, are eligible to participate.
Is the information provided to the NCSC kept confidential?
Yes, the NCSC states that all information provided will remain confidential and participation is entirely voluntary.
How does one register for this research initiative?
Interested individuals should complete the registration form hosted by Optimal Workshop, which takes no longer than five minutes to complete.
