blog post  Download / Print article PDF ##### ShareCopied to clipboard ##### Share##### Facebook##### Linkedin##### X##### Copy LinkCopied to clipboard ##### Share##### Facebook##### Linkedin##### X##### Copy LinkACD 2.0: Insights from the external attack surface management trials====================================================================We publish the results of our ACD 2.0 external attack surface management (EASM) trials Ollie Whitehouse, Jonathon Ellison Invalid DateTime  We [updated you in January](active-cyber-defence-2-easm-update) about the first stage of the NCSC’s ACD2.0 experiments, thanking those who had taken part.We said we would report more fully, and today we publish an account of what we have learned.This experiment gave the NCSC many insights, including:* Providers were keen to collaborate with us, highlighting the industry’s commitment to advancing cyber defence through innovative solutions.* Getting organisations to take part in trials as customers was more challenging, underscoring the need to have a better understanding of the risk to their external attack surface and how EASM products can help manage this.* Users gain significant cyber security benefits from a range of EASM features, not just from specific risks and issues data. Notably, features providing improved visibility of digital footprint allowed defenders to commission work to protect or decommission assets previously unknown to security teams.* Automated discovery provides valuable visibility of an organisation’s digital footprint, which is essential for effective cyber defence.* Guidance on what constitutes a good EASM product and how organisations should select one is lacking, and would be welcomed by both provider and customer organisations.* The commercial market for EASM is thriving, offering quality services at various price points — and there is no one-size-fits-all solution.* A wide variety of loosely defined language is used to describe scanning activities, leading to confusion and concern among customers.* Cost remains a crucial factor for organisations when selecting tools and solutions — where budget is limited they need confidence they are choosing the right solution to meet their needs. The insights from our experiments highlight the importance of collaboration, clear communication, and authoritative guidance in the evolving field of attack surface management.The NCSC, as the UK’s National Technical Authority for cyber security, will look to address the identified gaps, and support organisations in making informed decisions about their cyber security strategies.By promoting a deeper understanding of EASM and its benefits, the NCSC will help UK organisations to enhance their cyber defences and navigate the complex landscape of digital threats. *** ** * ** ***Downloads———[* pdf* 923 KB#### ACTIVE CYBER DEFENCE 2.0 Attack surface management experimentsReport on the ACD2.0 external attack surface management trials](https://www.ncsc.gov.uk/files/Active-Cyber-Defence-2-ASM-experiment.pdf) Topics——[Active Cyber Defence](https://www.ncsc.gov.uk/section/advice-guidance/all-topics?topics=Active Cyber Defence)|  | Back to top |  | Download / Print article PDF || ##### Share|| Copied to clipboard || ##### Share|| || ##### Facebook|| || ##### Linkedin|| || ##### X|| || ##### Copy Link|| Copied to clipboard || ##### Share|| || ##### Facebook|| || ##### Linkedin|| || ##### X|| || ##### Copy Link||  || ##### Written By|| Ollie Whitehouse|| Chief Technology Officer (CTO), NCSC |  || ##### Written By|| Jonathon Ellison|| NCSC Director of National Resilience | * || ##### Published|| * 6 March 2025| *|| ##### Written For|| * [Cyber security professionals](/section/advice-guidance/cyber-security-professionals)| *|| ##### Part of blog|| * [Events and initiatives](/section/keep-up-to-date/ncsc-blog)|  || ##### Written By|| Ollie Whitehouse|| Chief Technology Officer (CTO), NCSC |  || ##### Written By|| Jonathon Ellison|| NCSC Director of National Resilience| * || ##### Published|| * 6 March 2025| *|| ##### Written For|| * [Cyber security professionals](/section/advice-guidance/cyber-security-professionals)| *|| ##### Part of blog|* [Events and initiatives](/section/keep-up-to-date/ncsc-blog)  Back to top
Related Tags:
NAICS: 541 – Professional
Scientific
Technical Services
NAICS: 92 – Public Administration
NAICS: 922 – Justice
Public Order
Safety Activities
Blog: NCSC Reports
Guidance and Blog-post
Clipboard Data
Associated Indicators: