This blog article offers a critical yet constructive reflection on the UK’s Cyber Resilience Testing (CRT) initiative. While CRT is conceptually sound and timely, significant questions remain around cost, demand, usability, policy intent, and delivery responsibility. The article explores whether CRT is positioned to become a meaningful standard or risks being sidelined as another voluntary layer. It advocates for clearer articulation of purpose, audience targeting, and strategic alignment to unlock CRT’s full potential.
Contents
Introduction
As the UK’s Cyber Resilience Testing (CRT) scheme matures, it stands at a critical inflection point. The intentions are clear: to raise product security standards, provide transparent assurance, and streamline procurement for both public and private sectors. Yet, as with any initiative in its formative stages, there remain significant structural, behavioural, and strategic questions to address.
The following reflections are drawn from survey data, stakeholder interviews, and broader engagement across the sector. They are offered not as critique for critique’s sake, but as a constructive contribution to the ongoing evolution of CRT — an initiative with real promise, but also real risk of failing to deliver on its ambitions without further clarity and direction.
1. Cost to Vendors & Barriers to Adoption
The commercial model remains one of CRT’s most challenging elements. There is no consensus on pricing:
- SMEs, which form the backbone of the UK’s tech and IoT ecosystem, are highly price-sensitive.
- Larger organisations, while more capable of absorbing costs, expect a clear return on investment.
Adoption is further hindered by compliance fatigue, limited demand signals from buyers, and absence of cyber insurance incentives. While CRT promises long-term assurance value, the short-term proposition is difficult to justify in the absence of market pull.
A few structural blockers persist:
- Customer buy-in is inconsistent
- Market demand is weak and poorly timed
- CRT risks duplicating existing standards (e.g. ISO 27001, NIST, Cyber Essentials)
- Many organisations do not yet see how CRT fits into procurement or compliance workflows
A more flexible, tiered pricing model, or “pay-after” commercial options, may unlock early adoption. But without clear drivers from buyers or regulators, vendors will continue to struggle to justify investment.
2. Programme Delivery Costs: Awareness & Engagement
For CRT to reach the right audiences — and more importantly, to matter to them — it must be backed by sustained investment in education, sector-specific engagement, and public communications.
The challenge here is not technical, but structural:
- CRT will not sell itself — at least not yet.
- It will require trusted intermediaries, onboarding partners, and community-level advocates to achieve critical mass.
- There is currently no clear plan for how the programme scales or who absorbs long-term costs.
In this light, CRT may struggle to move beyond early pilot enthusiasm into something embedded in national cyber assurance infrastructure — unless delivery responsibilities are clearly defined.
The wider uncertainty around the NCSC’s future role — policy shaper or delivery agency — further clouds expectations. If the CRT becomes a hybrid public-private initiative, this needs to be communicated with transparency and intention.
3. Audience Maturity & Report Usability
The CRT report itself is central to the scheme’s value — but its current level of technical detail assumes a maturity that many recipients do not have.
Only large organisations and government departments are likely to have security architects or assurance professionals able to interpret the findings. For SMEs or less mature buyers, the risk is clear: technically sound outputs may fail to translate into meaningful action.
Without:
- clear contextual guidance,
- tiered outputs suitable for non-expert consumption, and
- integration into procurement workflows,
CRT risks becoming an expensive technical artefact, rather than a useful tool for decision-making.
This is particularly important if CRT is to be used in public-facing schemes or consumer protection contexts. The outputs must be intelligible, actionable, and credible to those making risk-based decisions — not just to cybersecurity professionals.
4. The Future of the NCSC & Strategic Positioning
CRT’s development raises bigger questions about the long-term trajectory of the NCSC itself. Are we witnessing a return to CESG-style assurance — centralised, government-backed product evaluation — or the emergence of a more agile, decentralised trust ecosystem?
The current ambiguity undermines confidence:
- Will CRT remain a pilot or become a national standard?
- Who owns the infrastructure, certification process, and trust architecture?
- Is this primarily a public policy intervention, or a market-led mechanism with government endorsement?
Clarity is critical. Without it, the initiative risks becoming stuck in the “worthy but not required” category — respected but ignored.
5. Who Wants It, Why, and When?
Perhaps the most fundamental question is: who is asking for CRT, and why now?
- Vendors are interested, but their motivation is mostly product differentiation, not regulatory necessity.
- Customers — particularly those in procurement or risk management — have not clearly voiced demand, nor been empowered to use CRT in purchasing decisions.
There is a risk that CRT is a solution in search of a problem. Unless a particular sector, threat profile, or government buyer urgently needs CRT today, it may be difficult to sustain momentum.
A clearer articulation of “who benefits, when, and how” would strengthen the business case — especially if it can be linked to tangible outcomes like:
- procurement pre-qualification,
- cyber insurance incentives,
- or simplified compliance with existing frameworks.
6. What Behaviour Is the Government Trying to Drive?
Ultimately, the success of CRT will hinge not on technical merit, but on policy coherence.
Is this initiative intended to:
- Raise the baseline for product security?
- Encourage transparency in vendor claims?
- Create a lightweight, evidence-based alternative to full certification?
- Signal that self-attestation is no longer enough?
At present, CRT risks being interpreted as “yet another voluntary label”, rather than as a strategic intervention to shift market behaviours.
For CRT to fulfil its promise, government must clearly define:
- What behavioural change is expected of vendors and buyers
- What outcomes are being pursued (e.g. reduced incidents, improved resilience)
- How CRT integrates into the wider UK and international assurance landscape
Conclusion: A Work in Progress with Real Potential
Cyber Resilience Testing is an ambitious and timely initiative, but ambition alone won’t guarantee adoption.
Without:
- clear demand from buyers,
- supportive policy incentives, and
- a delivery model designed for scale and accessibility,
CRT risks being respected but underused — a smart idea stranded between public good and market inertia.
However, if those challenges can be addressed, CRT has the potential to anchor a new kind of digital product assurance — one that is scalable, evidence-based, and grounded in both technical rigour and practical usability.
In short: CRT is worth doing. But it must now be defined not just by its good intentions, but by its clarity of purpose and quality of execution.