Full Report
We're looking to hear from people involved in evaluating, selecting or adopting EASM.
Analysis Summary
# Industry News: NCSC Signals Strategic Shift in EASM Guidance through National Research Initiative
## Summary
The UK’s National Cyber Security Centre (NCSC) has launched a comprehensive research initiative to investigate how organizations evaluate, select, and adopt External Attack Surface Management (EASM) solutions. This study is a critical component of the NCSC’s "Active Cyber Defence (ACD) 2.0" strategy, aimed at refining national guidance and potentially developing government-backed tools for exposure management.
## Key Details
- **Date:** October 12, 2026
- **Companies Involved:** National Cyber Security Centre (NCSC)
- **Category:** Market Research / Strategic Policy Development
## The Story
Building on earlier research into how organizations *use* EASM tools, the NCSC is now pivoting to investigate the "pre-adoption" phase. The agency is calling for cybersecurity leaders, procurement specialists, and risk managers to share their decision-making processes regarding external attack surface risks.
The NCSC is specifically looking to identify the friction points in the procurement lifecycle: how business cases are built, how vendors are compared, and what technical requirements drive the selection of EASM and Exposure Management platforms. This research is set against the backdrop of the NCSC retiring legacy tools like "Web Check" and "Mail Check" in early 2026, signaling a move toward more sophisticated, automated defensive capabilities under the ACD 2.0 banner.
## Business Impact
### For the Companies Involved (NCSC)
- Positions the NCSC as a sophisticated orchestrator of national defense, moving beyond basic scanning to understanding the economic and strategic hurdles of enterprise-grade security.
### For Competitors (Commercial EASM Vendors)
- **Market Influence:** NCSC’s eventual guidance will likely set the standard for "what good looks like" in EASM, potentially picking winners and losers based on which features the NCSC prioritizes (e.g., discovery accuracy vs. prioritization logic).
- **Potential Disruption:** If the NCSC develops high-quality, free alternative tools under ACD 2.0, lower-tier commodity EASM vendors may see a reduction in their addressable market.
### For Customers
- **Clearer Guidance:** Organizations will eventually receive evidence-based frameworks for selecting EASM tools, reducing "vendor noise" in a crowded market.
- **Alignment:** Procurement teams can better align their security investments with national best practices.
### For the Market
- **Standardization:** The research highlights EASM’s transition from a "nice-to-have" niche to a core requirement of modern cybersecurity governance.
- **Shift to Exposure Management:** The focus on "Exposure Management" (CTEM) suggests the market is moving away from simple asset discovery toward risk-based prioritization.
## Technical Implications
The NCSC is focusing on the technical challenges of **shadow IT discovery**, **asset attribution**, and **vulnerability prioritization**. By investigating how organizations "assess external attack surface risks," the NCSC is looking for technical gaps where current commercial tools may be failing to provide sufficient visibility into complex, cloud-native environments.
## Strategic Analysis
- **Market Positioning:** The NCSC is reinforcing its role as a "Consultant-in-Chief" for the UK private and public sectors, ensuring that national defense isn't just about technology, but about effective procurement and risk strategy.
- **Competitive Advantage:** For the UK, this research creates a feedback loop between private sector struggles and national policy, potentially leading to a more resilient digital economy.
- **Challenges:** The primary risk is "participation fatigue" from security leaders and the difficulty of synthesizing diverse organizational needs into a single set of guidance.
## Industry Reactions
- **Analyst Opinions:** Analysts view this as a necessary step to professionalize the EASM space, which has been characterized by high marketing spend and varying product efficacy.
- **Market Response:** The focus on "Active Cyber Defence 2.0" suggests a more proactive stance from the government, which is generally welcomed by enterprises looking for authoritative benchmarks.
## Future Outlook
- **Predictions:** Expect the NCSC to release a "Buyer’s Guide for EASM" or an updated "Cyber Assessment Framework (CAF)" inclusion for attack surface management in late 2026 or 2027.
- **What to Watch For:** The launch of new ACD 2.0 services that might offer automated "proactive notifications" of vulnerabilities to UK-based IP ranges, potentially competing with entry-level commercial scanners.
## For Security Professionals
Practitioners should consider participating in the research to ensure that the unique challenges of their specific industry (e.g., OT/ICS, high-compliance finance) are reflected in future national standards. For those currently evaluating EASM, this announcement serves as a reminder to focus not just on "finding" assets, but on the **governance and business case** for how those findings are remediated.