UK NCSC Seeks Input on External Attack Surface Management Procurement Decisions

The UK National Cyber Security Centre (NCSC) has launched a new call for participants to help shape its guidance on external attack surface management (EASM). According to an official advisory published on the NCSC website, the agency is specifically seeking insights from organizations involved in evaluating, selecting, or adopting EASM solutions. This effort aims to understand the decision-making processes that precede the implementation of these security tools.

The NCSC previously invited organizations with existing EASM and exposure management experience to participate in its ACD 2.0 research earlier this year. Through those conversations, the agency gained valuable insights into how organizations use these solutions in practice, including how they review findings, prioritize activities, and respond to potential risks. The new phase shifts focus to the earlier stages of that lifecycle.

Research Focus and Methodology

The NCSC is now interested in understanding the considerations, challenges, and decisions organizations face as they determine what support, tools, or services best meet their needs. The agency wants to learn about the process of identifying organizational needs, evaluating options, and building business cases. This includes influencing investment or procurement decisions, selecting suppliers, and shaping the organization's overall approach to external attack surface risk.

Sharing experiences will help the NCSC shape better guidance and services for organizations managing external attack surface risk. Participation is entirely voluntary, and all information provided will remain confidential. The NCSC states that taking part may involve a range of activities, depending on the participant's role and the agency's current areas of focus.

Who Should Participate

The NCSC is particularly keen to hear from people involved in cyber security governance, assurance, or strategic leadership. The agency also seeks input from those who evaluate cyber security tools, services, or technologies, and those who contribute to cyber risk management activities. Individuals who influence or make cyber security investment decisions are also targeted for this research.

Additionally, the NCSC wants to hear from professionals who manage procurement, purchasing, or supplier selection activities. The agency is interested in anyone who has recently been involved in decisions relating to external attack surface management, exposure management, or related security capabilities. Whether considering EASM for the first time or having recently implemented a solution, the NCSC wants to learn from these experiences.

What should you do?

Organizations interested in helping the NCSC should complete a registration form hosted by Optimal Workshop. The form takes no longer than five minutes to complete and helps the NCSC understand the participant's role and experience. Once registered, the individual will be added to the research panel for future activities. The NCSC will contact suitable participants via email if an opportunity arises that fits their experience.

What to do and how to stay safe: NCSC

• Review your organization's current external attack surface management strategy and identify any gaps in your procurement or evaluation process.
• Determine if your role involves decision-making for security tools, risk management, or procurement to see if you qualify for the NCSC research.
• Complete the registration form hosted by Optimal Workshop if you wish to contribute to the NCSC's ACD 2.0 research efforts.
• Share the invitation with colleagues involved in cyber security decision-making, procurement, governance, or risk management activities.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the NCSC researching regarding EASM?

The NCSC is researching how organizations approach external attack surface risk, specifically focusing on the evaluation, selection, and adoption of EASM solutions.

Who is eligible to participate in this research?

People involved in evaluating, selecting, or adopting EASM, as well as those in procurement, risk management, and strategic security leadership, are eligible.

Is participation in the NCSC research mandatory?

No, participation is entirely voluntary, and all information provided by participants will remain confidential.