Guides

Security Guides.

In-depth guides covering Cyber Essentials updates, compliance changes, and practical security advice for UK businesses.

Jump to a Topic Library

87 guides

Passing Cyber Essentials →

21 guides

Penetration Testing →

167 guides

Can Your CE Basic Certificate Be Revoked? What Happens When You Fail CE Plus Under Danzell

Under Danzell, failing the CE Plus second sample scan can revoke your CE Basic certificate too. Here is how revocation works, what it costs, and how to prevent it.

9 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus First-Time Pass: What Danzell Actually Requires

Under Danzell, CE Plus scans must pass first time. No remediation during the assessment. Here is the double sampling process, what triggers it, and how to prepare.

8 min read

Read Guide

Cyber Essentials

Why RMM Scanners and Windows Defender Will Fail Your Cyber Essentials Plus Assessment

RMM tools and Windows Defender are not approved for CE Plus internal vulnerability scans. Here is what the assessment actually requires and why your IT provider's scanner will miss critical vulnerabilities.

7 min read

Read Guide

Cyber Essentials

Willow to Danzell: What to Do If You Have an Open Cyber Essentials Account

IASME retires the Willow question set on 27 April 2026. If you have an open Willow account, here are the deadlines, what happens if you miss them, and what to do next.

8 min read

Read Guide

Business & Sector

Bank Suppliers and Cyber Essentials: The Six-Bank Commitment and FSQS

Six major UK banks have committed to requiring Cyber Essentials from suppliers. 61% prefer CE-certified suppliers and 33% plan to mandate it. Here's what the banking supply chain commitment means for your business.

6 min read

Read Guide

Business & Sector

What the Cyber Security and Resilience Bill Means for MSPs

The CSRB brings medium and large managed service providers under NIS regulation for the first time. Here's what it requires, when it takes effect, and what MSPs should do now.

4 min read

Read Guide

Business & Sector

DEFCON 658: Cyber Essentials Requirements for the Defence Supply Chain

MOD DEFCON 658 requires Cyber Essentials across the entire defence supply chain. CE minimum for all contracts, CE+ for most risk levels. Here's how it works, who it applies to, and what DEF STAN 05-138 means for suppliers.

7 min read

Read Guide

Business & Sector

Free Cyber Insurance with Cyber Essentials: What You Get and How to Upgrade

Every Cyber Essentials certificate includes free £25,000 cyber insurance. Five major UK insurers use CE as a baseline. Here's exactly what's covered, the 80% claims reduction, and how to upgrade to £100K or £250K.

6 min read

Read Guide

Business & Sector

G-Cloud 15: Cyber Essentials Will Be Required for All Suppliers

G-Cloud 15 makes Cyber Essentials mandatory for all supplier lots when it goes live in September 2026. CE+ is required for cloud hosting. Here's what changed and what suppliers need to do now.

4 min read

Read Guide

Business & Sector

NHS Suppliers: Cyber Essentials and CE+ Are Now Mandatory

NHS supply chain organisations handling patient data must now hold Cyber Essentials and CE+ certification. Here's what changed, who it affects, and how to get certified in under a week.

4 min read

Read Guide

Business & Sector

PPN 014: Which Government Contracts Require Cyber Essentials?

Procurement Policy Note 014 makes Cyber Essentials mandatory for government contracts involving data or ICT. Here's which contracts are affected and what suppliers must do.

4 min read

Read Guide

Business & Sector

The Full Cyber Security Journey: CE Basic to Pen Testing

From Cyber Essentials Basic at £320 to penetration testing. The complete path through CE Plus, Cyber 365, and beyond, with pricing at each stage and why each step matters.

8 min read

Read Guide

Business & Sector

Cyber Essentials Plus in 5 Days: NHS Wales Contractor Case Study

How Net Sec Group delivered Cyber Essentials and CE Plus certification to an NHS Wales contractor in 5 days to meet a contract deadline. The full process from scoping to certification.

7 min read

Read Guide

Cyber Essentials

How Long Does a Cyber Essentials Plus Assessment Take?

CE Plus testing takes 1-3 days depending on your sample size. But the timeline starts at basic CE and has mandatory windows you can't compress.

6 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus Assessment Process: What Actually Happens

Five test cases, a sampling methodology, and a 30-day remediation window. Here's what the CE Plus assessment covers and what to expect.

7 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus Sample Sizes: How Many Devices Get Tested?

CE Plus doesn't test every device. The IASME sampling table determines how many from each OS build, with servers always tested. Here's how the calculation works.

5 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus Second Sample Rule: What Happens When Your First Scan Fails

The cyber essentials plus second sample rule means a failed scan triggers a second random sample. One 30-day window covers both. Here is how it works.

10 min read

Read Guide

Cyber Essentials

How to Prepare for Cyber Essentials Plus: What to Do Before the Assessor Arrives

Practical CE Plus preparation from a Lead Assessor. Run your own scans, check MFA works, verify patches on every device, and get your evidence ready.

14 min read

Read Guide

Cyber Essentials

What Happens If You Fail Cyber Essentials Plus?

What actually happens when a CE Plus assessment finds problems, what the remediation window looks like, and how double sampling works under Danzell.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials FAQ Database: 327 Questions Answered

Complete Cyber Essentials FAQ covering technical requirements, CE Plus, cloud services, MFA, BYOD, costs, and common failures. Written by a CREST-registered assessor.

109 min read

Read Guide

Research & Intelligence

The Stryker Attack: When Your Own Device Management Becomes the Weapon

How Iranian-linked hackers weaponised Stryker's Microsoft Intune to wipe devices globally, disrupting medical device manufacturing across 79 countries.

11 min read

Read Guide

Business & Sector

The 6 Things Cyber Essentials Doesn't Cover

CE covers Protect. Here are the five NIST functions it misses, with real consequences for each gap.

6 min read

Read Guide

Cyber Essentials

Backup and Recovery: What Cyber Essentials Does and Does Not Require

Cyber Essentials does not require backups. But a ransomware attack without them turns a bad day into a business-ending event. Here is how to think about it.

7 min read

Read Guide

Penetration Testing

Configuration Review: What It Is and Why It's Part of a Security Assessment

What a configuration review tests, how it differs from a vulnerability scan, and what it reveals about your actual security posture. Written by a CREST-registered pen tester.

5 min read

Read Guide

Business & Sector

The Cost of Not Having an Incident Response Plan

Synnovis: GBP 32.7M. British Library: GBP 6-7M. Both had security controls. Neither had a tested response plan. Here's what that cost them.

6 min read

Read Guide

Business & Sector

Cyber 365 for Financial Services: Meeting FCA and DORA Requirements

The FCA expects operational resilience testing. DORA requires ICT risk management. CE covers one function. Here's how Cyber 365 bridges the gap.

6 min read

Read Guide

Business & Sector

Cyber 365 for Law Firms: Security Beyond Cyber Essentials

The SRA expects more than CE covers. Here's how Cyber 365 maps all six NIST functions to the regulatory requirements law firms actually face.

6 min read

Read Guide

Business & Sector

Cyber 365 for NHS Suppliers: Beyond CE Plus and DSPT

NHS procurement requires CE Plus. DSPT requires 10 security standards. Both leave gaps. Here's how Cyber 365 maps to the full NHS supplier security expectation.

6 min read

Read Guide

Business & Sector

Cyber 365: How Our Security Framework Works

Six NIST functions, one programme. How Cyber 365 maps existing services to continuous security coverage.

6 min read

Read Guide

Cyber Essentials

How to Verify a Cyber Essentials Certificate Is Genuine

How to check if a Cyber Essentials certificate is real, current, and covers the right scope. The IASME register and what to look for.

4 min read

Read Guide

Cyber Essentials

Cyber Essentials Certification Guide: What It Is, What It Costs, and How to Get It

The complete guide to Cyber Essentials certification in the UK. Five controls, two levels, one assessment process. Written by an assessor who's certified over 800 businesses.

6 min read

Read Guide

Business & Sector

Cyber Essentials for Financial Services: FCA, DORA, and Scope

Financial services firms face overlapping regulatory expectations on cybersecurity. Cyber Essentials maps directly to FCA operational resilience rules. Here's how.

9 min read

Read Guide

Business & Sector

Cyber Essentials for Government Contractors: What You Need to Know

Government contracts involving personal data or IT services require Cyber Essentials certification. Here is what the requirement means and how to meet it.

7 min read

Read Guide

Business & Sector

Cyber Essentials for Law Firms: SRA Obligations and Client Data

Law firms handle privileged client data daily. Cyber Essentials maps directly to your SRA obligations. Here's what the certification covers and where firms fail.

9 min read

Read Guide

Cyber Essentials

Cyber Essentials with Legacy Systems: How to Get Certified Without Replacing Everything

How to achieve CE certification when you have unsupported operating systems, legacy applications, or equipment that can't be updated. Sub-scoping, compensating controls, and what assessors actually accept.

5 min read

Read Guide

Cyber Essentials

How to Display the Cyber Essentials Logo Correctly

Where to put the CE badge on your website, email signatures, and documents. What you can and can't do with the logo, and why the verification link matters.

4 min read

Read Guide

Cyber Essentials

Cyber Essentials Marking Scheme: How Your Assessment Is Actually Scored

Four outcomes, a two-strike rule, and assessors who cross-reference every answer. Here's how the CE marking scheme works and what trips people up.

6 min read

Read Guide

Cyber Essentials

Cyber Essentials Password Requirements Under Danzell

What CE requires for passwords and authentication under the Danzell update. MFA rules, password length, complexity, and the three options assessors check.

5 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus Remote Testing: How It Works

Most CE Plus assessments run remotely now. Here's what the assessor needs, how they verify real devices, and when an on-site visit still makes sense.

5 min read

Read Guide

Cyber Essentials

Cyber Essentials Remote Working: Controls for Distributed Teams

Home routers become boundary firewalls. Personal phones become in-scope devices. Here's how to implement CE controls when your team works from everywhere.

6 min read

Read Guide

Cyber Essentials

User Access Control Implementation for Cyber Essentials

How to implement the access control requirements for CE. Admin account separation, MFA, least privilege, and the practical steps that pass assessment.

5 min read

Read Guide

Business & Sector

Cyber Essentials vs Cyber 365: What's the Difference?

CE covers one NIST function. Cyber 365 covers all six. Here's what each includes, what they cost, and which one your business actually needs.

6 min read

Read Guide

Business & Sector

Cyber Essentials vs ISO 27001: Which Certification Do You Need?

CE takes weeks and covers five technical controls. ISO 27001 takes months and covers your entire security management system. Here's how to choose.

6 min read

Read Guide

Business & Sector

Your Managed IT Provider Is About to Be Regulated

The Cyber Security and Resilience Bill brings MSPs into regulation. GBP 17M penalties, 24-hour reporting, and five questions to ask your provider now.

10 min read

Read Guide

Cyber Essentials

Why Danzell Makes Cyber Essentials Plus Worth Having

Danzell CE+ with whole-org scope, fortnightly scanning, and fortnightly patching is the first time CE has delivered genuine security. This article makes the case.

17 min read

Read Guide

Cyber Essentials

Danzell Readiness Checklist: Are You Ready for CE v3.3?

A practical checklist covering every change you need to make before the Danzell question set takes effect on 27 April 2026.

10 min read

Read Guide

Cyber Essentials

DNS Filtering for Cyber Essentials: Does It Count?

DNS filtering is not a Cyber Essentials requirement, but it strengthens your browser security controls and helps block malicious content before it loads.

7 min read

Read Guide

Business & Sector

Do You Need More Than Cyber Essentials?

CE covers one of six security functions. Whether that's enough depends on what you're protecting, who you report to, and what happens when something gets through.

6 min read

Read Guide

Cyber Essentials

MFA Edge Cases for Cyber Essentials: What Counts and What Doesn't

Email verification, IP restrictions, Windows Hello, service accounts, shared logins, and session timeouts. Which ones actually satisfy the MFA requirement under v3.3.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus Vulnerability Scanning: What Gets Scanned, What Fails, and How to Prepare

CE Plus includes internal and external vulnerability scanning by the assessor. This guide covers what devices get scanned, what the assessor looks for, common failure causes, and how to prepare.

7 min read

Read Guide

Cyber Essentials

Windows 10 End of Life and Cyber Essentials: What It Means If You Haven't Upgraded

Windows 10 support ended 14 October 2025. If you're still running it without Extended Security Updates, you're already failing Cyber Essentials. Here's what to do.

9 min read

Read Guide

Cyber Essentials

How Long Does Cyber Essentials Take? Realistic Timelines from an Assessor

Honest timelines for CE Basic and CE Plus from an assessor who's certified 800+ businesses. Preparation, assessment, and certification timescales.

5 min read

Read Guide

Cyber Essentials

IASME Certification Process: How Cyber Essentials Assessment Works

IASME is the sole delivery partner for Cyber Essentials. Here's how the certification process works from application to certificate, for both Basic and Plus.

6 min read

Read Guide

Penetration Testing

Infrastructure Pen Testing: What We Actually Test on Your Network

External scans tell you half the story. Here is what a CREST tester checks on your internal network, servers, and Active Directory.

10 min read

Read Guide

Business & Sector

Iran Cyber Warning: What CE Covers and What It Doesn't

The NCSC Iran advisory maps to one NIST function. CE covers Protect. What about the other five? Here's where the gaps are.

7 min read

Read Guide

Cyber Essentials

Lancaster University Cyber Essentials Study: What the Evidence Actually Says

200 vulnerabilities tested against CE's five controls. 131 fully mitigated, 60 partially mitigated, 9 unmitigated. Here's what that means for your business.

5 min read

Read Guide

Cyber Essentials

MDM for Cyber Essentials: When It Is Worth It and How to Deploy

MDM is not a Cyber Essentials requirement. But for organisations with more than about 30 mobile devices, it makes compliance easier to prove and maintain.

8 min read

Read Guide

Cyber Essentials

NCSC Iran Checklist vs Cyber Essentials: Quick-Reference Comparison

Every NCSC recommendation from the Iran cyber advisory mapped against CE controls. What overlaps, what doesn't, and what you need beyond CE.

4 min read

Read Guide

Cyber Essentials

NCSC Iran Cyber Warning: What UK Businesses Should Do

The NCSC Iran cyber warning maps to Cyber Essentials controls. 149 DDoS attacks logged in 72 hours. Here's your action checklist.

8 min read

Read Guide

Cyber Essentials

Network Segmentation for Cyber Essentials: What You Actually Need

Network segmentation is not a Cyber Essentials requirement, but it changes what falls in scope. Here is how segmentation affects your assessment.

5 min read

Read Guide

Business & Sector

NIST Cybersecurity Framework for UK Businesses: A Plain English Guide

NIST CSF 2.0 organises cyber security into six functions. Most UK businesses only cover one. Here's what each function means and why it matters.

7 min read

Read Guide

Cyber Essentials

Our Cyber Essentials Plus Methodology: How We Run the Assessment

External scans, internal authenticated testing, EICAR verification, MFA checks, and account separation. Here's exactly how we conduct CE Plus assessments.

6 min read

Read Guide

Cyber Essentials

Password Managers and Cyber Essentials: What You Need to Know

Password managers help meet the CE password requirements. Here is how they fit into the User Access Control section and what the assessor expects.

5 min read

Read Guide

Penetration Testing

Penetration Testing FAQ: What Buyers Actually Ask Us

Straight answers to the questions businesses ask before buying a pen test. CREST, CHECK, cost, timing, and what the report looks like.

10 min read

Read Guide

Penetration Testing

Penetration Testing: What UK Businesses Need to Know

A pen test is not a scan. This guide explains what penetration testing involves, when you need one, and what to look for in a tester.

9 min read

Read Guide

Cyber Essentials

Qilin Ransomware and the NHS: How Five Controls Could Have Closed the Front Door

Qilin disrupted NHS blood tests for six months. Their attack used techniques Cyber Essentials is designed to stop. Here's the full kill chain.

9 min read

Read Guide

Cyber Essentials

RDP Security: What CE Assessors Find and How to Fix It

Remote Desktop Protocol exposed to the internet is one of the most common CE failures. Here is what to check and how to secure it.

7 min read

Read Guide

Cyber Essentials

SMBv1: Why It Needs Disabling for Cyber Essentials

SMBv1 is the protocol WannaCry used. It should be disabled on every machine. Here is how to check and how to fix it.

7 min read

Read Guide

Cyber Essentials

TLS 1.0 and 1.1: Why They Need Disabling for CE

TLS 1.0 and 1.1 are deprecated protocols with known weaknesses. Here is how to check if they are still enabled and how to disable them.

7 min read

Read Guide

Cyber Essentials

WinTrust Certificate Padding Check: What It Is and How to Enable It

The WinTrust registry setting prevents tampered executables from appearing legitimate. Here is why CE assessors check it and how to enable it.

7 min read

Read Guide

Cyber Essentials

Security Awareness Training: What Actually Changes Behaviour

Annual slideshows don't stop phishing. Here is what a CE assessor sees working, and what he sees failing, across 800+ certifications.

9 min read

Read Guide

Penetration Testing

Social Engineering Testing: What It Involves and When You Need It

Phishing simulations are one part. Real social engineering testing covers phone calls, physical access, and the human decisions no scanner checks.

9 min read

Read Guide

Penetration Testing

Types of Penetration Testing: Which One Do You Need?

External, internal, web app, API, wireless, social engineering. Each type of pen test checks different things. This guide explains which ones matter for your business.

6 min read

Read Guide

Business & Sector

UK Ransomware Payment Ban: What Your Business Can't Do Anymore

The UK government confirmed a ransomware payment ban for public sector and CNI, with a prevention regime for everyone else. What it means for your business.

10 min read

Read Guide

Penetration Testing

Vulnerability Assessment vs Penetration Testing: What's the Difference?

A vulnerability assessment finds known weaknesses. A penetration test exploits them. Both are useful, but they are not interchangeable.

6 min read

Read Guide

Business & Sector

What Happens Between Cyber Essentials Certifications?

Your CE certificate lasts 12 months. Your security posture doesn't pause for 364 days. Here's what drifts and what to do about it.

5 min read

Read Guide

Cyber Essentials

What Vulnerability Scans Find That Auto-Updates Miss

Auto-updates miss third-party applications entirely, and built-in RMM scanners don't catch what an assessor's dedicated scanner finds.

8 min read

Read Guide

Business & Sector

Why Cyber Essentials Isn't Enough for Your Business

CE covers one of six security functions. The other five are where breaches actually cause damage. Here's what's missing.

7 min read

Read Guide

Business & Sector

Why Your MSP's 'Managed Security' Isn't Enough

Most MSPs manage your firewall and push patches. That covers Protect. Five of six NIST functions remain unaddressed. Here's what 'managed security' usually means and what it doesn't.

6 min read

Read Guide

Cyber Essentials

Wireless Security and Cyber Essentials: What the Assessment Covers

Your Wi-Fi network is in scope for Cyber Essentials. Here is what the requirements actually say about wireless security and what catches people out.

7 min read

Read Guide

Penetration Testing

Active Directory Attacks Explained: What We Find on Internal Networks

Active Directory attacks are among the most common findings on internal pen tests. Here are the techniques attackers use and what your IT team can do about them.

9 min read

Read Guide

Penetration Testing

Building AI-Assisted Security Assessments

How AI is being integrated into Cyber Essentials and pen testing assessments. What it speeds up, what it can't replace, and where the line sits.

11 min read

Read Guide

Penetration Testing

10 Cybersecurity Areas AI Is Already Changing

AI is changing how attacks happen and how defences work. Ten areas where it matters now, assessed honestly by a pen tester.

11 min read

Read Guide

Penetration Testing

AI in Cybersecurity: What's Real, What's Marketing, and What Matters

A pen tester's honest assessment of where AI genuinely changes cybersecurity and where vendors are just rebranding old tools.

9 min read

Read Guide

Penetration Testing

Can AI Actually Do a Pen Test?

AI tools find known vulnerabilities. Pen testers find the things no scanner checks for. The difference costs money when it matters.

9 min read

Read Guide

Penetration Testing

API Security Testing: What a Pen Tester Actually Checks

Most API tests are automated scans with a report. Here is what a CREST tester actually checks and why it matters.

7 min read

Read Guide

Penetration Testing

Automated Compliance Monitoring with Playwright and N8N

How we use Playwright and N8N to automate Cyber Essentials compliance checking. Continuous monitoring instead of annual surprises.

10 min read

Read Guide

Business & Sector

Boutique vs Large Consultancy: What Actually Differs in Cybersecurity

A boutique cybersecurity firm and a large consultancy both offer Cyber Essentials certification. Here's what actually differs in who does the work, who signs off, and what you pay.

9 min read

Read Guide

Cyber Essentials

BYOD and Cyber Essentials: What's in Scope and What to Do About It

When personal devices are in scope for Cyber Essentials, what the exceptions are, and practical approaches to BYOD compliance under Danzell.

9 min read

Read Guide

Penetration Testing

CREST Pen Testing Explained

What CREST certification means for penetration testing, the difference between individual and company accreditation, and why it matters when choosing a tester.

11 min read

Read Guide

Cyber Essentials

Cyber Essentials 30-Day Preparation Plan

A week-by-week plan to prepare for Cyber Essentials certification. What to fix first, what takes longest, and how to avoid last-minute scrambles.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials BYOD Policy: Which Personal Devices Are in Scope Under Danzell

A practical cyber essentials BYOD policy guide. Learn which personal devices fall in scope under Danzell v3.3, what's excluded, and how to classify them.

10 min read

Read Guide

Business & Sector

Cyber Essentials for Charities and Non-Profits

How charities and non-profits can achieve Cyber Essentials certification on a limited budget. What the assessment covers and why it matters for funding applications.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials Checklist 2026: Full Control-by-Control Guide for Danzell

A printable, control-by-control checklist for passing Cyber Essentials under the Danzell question set from 27 April 2026. Organised by scope, patching, MFA, firewalls, malware protection, secure configuration, and evidence.

12 min read

Read Guide

Cyber Essentials

The Most Common Cyber Essentials Failures (and How to Avoid Them)

The failure patterns that come up in assessment after assessment. What causes them, how to spot them before your assessor does, and how to fix them.

10 min read

Read Guide

Cyber Essentials

The Five Cyber Essentials Controls: A Technical Guide

What each of the five Cyber Essentials controls actually requires. Specific settings, thresholds, and configuration details for IT managers.

8 min read

Read Guide

Business & Sector

Cyber Essentials for Schools and Academy Trusts

Schools and MATs face unique Cyber Essentials challenges: shared devices, outsourced IT, student networks, and legacy MIS systems. Here's how to handle them.

14 min read

Read Guide

Cyber Essentials

Cyber Essentials for Startups: What You Actually Need

What startups need to know about Cyber Essentials. The five controls, what's in scope when you're small, and why early certification makes contract wins easier.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials FAQ: The Questions Businesses Actually Ask

Straight answers to the Cyber Essentials questions that come up most often, from scope and cost to MFA, patching, BYOD, and what happens when you fail.

10 min read

Read Guide

Business & Sector

Cyber Essentials for Healthcare and NHS Suppliers

Healthcare organisations handle special category patient data. Cyber Essentials maps directly to DSPT and NHS supply chain requirements. Here's where healthcare IT fails.

10 min read

Read Guide

Cyber Essentials

Malware Protection for Cyber Essentials: What You Need

What the Cyber Essentials malware protection control actually requires. What counts, what doesn't, and the configuration mistakes that cause failures.

9 min read

Read Guide

Cyber Essentials

Cyber Essentials for Multi-Site Businesses: One Certificate or Many?

How to handle Cyber Essentials when your business has multiple offices. Scope, networking, consistency, and whether you need separate certificates per site.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus Assessment Guide: What the Assessor Tests and How to Pass

CE Plus is a hands-on technical audit of your systems. Here is exactly what happens, what gets tested, and what you need to do to pass first time.

16 min read

Read Guide

Cyber Essentials

CE Plus vs CE Basic: What's the Difference?

Self-assessment vs technical audit. What each Cyber Essentials level involves, what it costs, and which one your business actually needs.

9 min read

Read Guide

Cyber Essentials

Cyber Essentials Renewal: What You Need to Know

How the Cyber Essentials renewal process works, when to start preparing, what changes between assessments, and the most common reasons organisations fail at renewal.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials Scope Changes Under Danzell: What's Now In Scope

Danzell v3.3 changes what falls in scope for Cyber Essentials. Cloud services can't be excluded, partial scope needs justification, and two qualifiers have been removed from the scope criteria.

11 min read

Read Guide

Cyber Essentials

Shared Admin Accounts and Cyber Essentials: Why They Fail and How to Fix Them

Shared admin accounts are one of the most common Cyber Essentials failures. Here's what the requirement says, why shared accounts fail, and how to restructure them.

9 min read

Read Guide

Cyber Essentials

Cyber Essentials Timeline: How Long Certification Takes in 2026

Realistic timelines for Cyber Essentials and CE Plus certification. How long each stage takes, what affects the timeline, and how to avoid delays.

10 min read

Read Guide

Cyber Essentials

Windows 365 and Contractor Devices: What's in Scope for Cyber Essentials?

How Windows 365 Cloud PCs, contractor devices, and virtual desktops fit into your Cyber Essentials scope. What counts, what doesn't, and where it gets complicated.

10 min read

Read Guide

Business & Sector

Cyber Insurance and Cyber Essentials: The Full Picture

How Cyber Essentials certification affects your cyber insurance premiums, policy terms, and claims. The UK market context and what insurers actually look for.

12 min read

Read Guide

Cyber Essentials

Danzell vs Willow: What Actually Changed in Cyber Essentials

Side-by-side comparison of Willow v3.2 and Danzell v3.3 Cyber Essentials requirements. Same five controls. Different scope, definitions, and enforcement.

10 min read

Read Guide

Cyber Essentials

Failed Cyber Essentials? Here's What to Do Next

What actually happens after a failed CE assessment, why most failures are fixable in days, and how to pass on your next attempt.

10 min read

Read Guide

Cyber Essentials

Cyber Essentials Plus Assessment Day: What to Expect and How to Prepare

A CE Plus assessment is a technical audit of your systems by an accredited assessor. Here's what happens on the day, what you need to prepare, and what catches people out.

9 min read

Read Guide

Cyber Essentials

Cloud Migration and Cyber Essentials: How Moving to the Cloud Changes Your Scope

Moving from on-premise to cloud changes your Cyber Essentials scope in ways most businesses don't expect. Here's what shifts, what stays the same, and where the shared responsibility model trips people up.

7 min read

Read Guide

Cyber Essentials

Cyber Essentials Cloud Service Inventory: How to Find Everything in Scope

Under Danzell, cloud services can't be excluded from your Cyber Essentials scope. Here's how to find every cloud service your business uses, and what the assessor checks.

7 min read

Read Guide

Cyber Essentials

Cyber Essentials Compliance Monitoring: Staying Compliant Between Assessments

CE certification lasts 12 months, but compliance can drift in weeks. Here is what to check quarterly and what to fix before renewal.

8 min read

Read Guide

Cyber Essentials

Contractor Devices and Cyber Essentials: When Are They in Scope?

Contractor laptops accessing your systems are in scope for Cyber Essentials. Here is what controls apply, what options you have, and how to handle the common edge cases.

8 min read

Read Guide

Cyber Essentials

Cyber Essentials and Incident Response: What the Scheme Covers (and What It Doesn't)

CE doesn't require an incident response plan. But when a breach happens during your certification year, your controls are the first thing that gets checked.

7 min read

Read Guide

Business & Sector

Cyber Essentials and Insurance: What Your Certificate Actually Gets You

Cyber Essentials certification includes £25,000 free cyber insurance and can reduce premiums by 5-15%. Here's how certification changes your insurance position, from claims handling to coverage terms.

8 min read

Read Guide

Cyber Essentials

macOS and Cyber Essentials: What Mac Users Need to Know

Macs aren't exempt from Cyber Essentials. Here's how macOS handles each of the five controls, what assessors check, and where Mac environments commonly fail.

8 min read

Read Guide

Cyber Essentials

Mobile Device App Allowlisting for Cyber Essentials: What You Actually Need

Which mobile devices are in scope for Cyber Essentials, what app controls apply, and how to manage application installation without expensive MDM.

8 min read

Read Guide

Business & Sector

Cyber Essentials ROI: The Business Case for Certification

Cyber Essentials costs from £320 + VAT. Here's what it saves, what contracts it unlocks, and how to present the business case to your board.

8 min read

Read Guide

Business & Sector

Why Financial Advisors Need Cyber Essentials

Financial advisors need Cyber Essentials because they handle portfolio data, tax records, and personal details daily. Here's what the certification covers and why it matters.

10 min read

Read Guide

Cyber Essentials

Firewalls and Antivirus for Cyber Essentials: What's Required

The specific firewall and antivirus requirements for Cyber Essentials. What settings you need, what products work, and where the assessment catches people out.

10 min read

Read Guide

Cyber Essentials

How Do You Know If You're Ready for Cyber Essentials?

A practical readiness check for Cyber Essentials covering all five controls. What to verify before your assessment so you don't waste time or money.

10 min read

Read Guide

Penetration Testing

How We Allocate Pen Testing Days

What determines how many days a pen test takes. Scope, assets, methodology, and the questions to ask before you get a quote.

10 min read

Read Guide

Penetration Testing

The HTTPS Fallacy: Why the Padlock Means Less Than You Think

HTTPS encrypts the connection. It says nothing about who you're connected to. A pen tester explains why the padlock is not a trust signal.

10 min read

Read Guide

Penetration Testing

How We Recreate Real Vulnerabilities in Our Lab

Most pen testers never show you what they actually find. We recreate real penetration testing findings in a controlled lab so you can see what we look for without exposing client data.

10 min read

Read Guide

Cyber Essentials

Linux Firewall Configuration for Cyber Essentials

How to configure iptables, nftables, or UFW to meet the CE firewall control. What the assessor checks and how to document it.

8 min read

Read Guide

Penetration Testing

LLMNR and NBT-NS Attacks: What Your IT Team Should Know

LLMNR and NBT-NS are enabled by default on Windows. Attackers use them to capture password hashes on internal networks. The fix takes minutes.

10 min read

Read Guide

Cyber Essentials

macOS Firewall Configuration for Cyber Essentials

How to configure the macOS firewall and security settings to meet the CE firewall control. What the assessor checks and how to document it.

5 min read

Read Guide

Cyber Essentials

MFA on Cloud Services for Cyber Essentials: What v3.3 Requires

Version 3.3 makes MFA mandatory on all cloud services with no scope exclusions. Here is what the requirement says, which services it covers, and what counts as MFA.

10 min read

Read Guide

Cyber Essentials

Mobile Device Protection for Cyber Essentials

What Cyber Essentials actually requires for phones and tablets. The requirements are simpler than most people think.

7 min read

Read Guide

Cyber Essentials

Passwordless Authentication and Cyber Essentials: What Counts Under Danzell

How passkeys, FIDO2 keys, and biometrics fit into Cyber Essentials under v3.3. What satisfies the MFA requirement and what doesn't.

9 min read

Read Guide

Penetration Testing

How Much Does a Pen Test Cost in the UK?

What penetration testing actually costs in the UK and what drives the price. Day rates, scope factors, and how to tell a real test from a rebranded scan.

10 min read

Read Guide

Cyber Essentials

Local Admin Rights: Why They Fail CE and How to Fix It

Local admin access is one of the most common Cyber Essentials failures. Here is what we find and how to restrict it properly.

6 min read

Read Guide

Cyber Essentials

PowerShell Execution Policies: What CE Assessors Check

An unrestricted PowerShell execution policy is a CE Plus failure. Here is what the assessor looks for and how to set the right policy.

6 min read

Read Guide

Cyber Essentials

Software Security Code of Practice: What Changed in Cyber Essentials v3.3

Version 3.3 replaces the OWASP ASVS reference with the UK government's Software Security Code of Practice. Here is what changed, what it means for your CE assessment, and whether you need to act.

7 min read

Read Guide

Cyber Essentials

Unsupported Software and Cyber Essentials: What to Do When You Can't Update

What happens when in-scope software reaches end of life. The CE rules, your options when you can't update, and how to handle legacy systems during assessment.

10 min read

Read Guide

Penetration Testing

Web App Pen Testing: What Gets Tested and Why It Matters

Web application testing checks the things your scanner can't see. Authentication flaws, access control gaps, and the business logic mistakes that cost money.

7 min read

Read Guide

Cyber Essentials

Windows 11 Hardening for Cyber Essentials: Settings That Actually Fail Assessments

Windows 11 defaults won't pass a Cyber Essentials assessment. Autoplay, admin accounts, firewall exceptions, and patch deferral all need fixing. Here's what to change.

10 min read

Read Guide

Cyber Essentials

Windows Defender Configuration for Cyber Essentials

Windows Defender meets the CE malware protection control when configured properly. Here is what the assessor checks and how to set it up.

6 min read

Read Guide

Cyber Essentials

Windows Firewall Configuration for Cyber Essentials

How to configure Windows Defender Firewall to meet the CE firewall control. PowerShell commands, Group Policy settings, and what the assessor checks.

6 min read

Read Guide

Cyber Essentials

Cyber Essentials 14-Day Patching: What the Requirement Actually Says and How to Meet It

The Cyber Essentials 14-day patching rule applies to vulnerabilities scored CVSS 7.0 or above, or described by the vendor as critical or high risk. This guide explains the requirement, what counts as a fix, and how to build a process that keeps you compliant.

11 min read

Read Guide

Cyber Essentials

Cyber Essentials v3.3: What the Danzell Update Changes and What You Need to Do

The Danzell update to Cyber Essentials takes effect 27 April 2026. Here is what actually changed in v3.3, what it means for your business, and how to prepare.

15 min read

Read Guide

Research & Intelligence

The JLR Cyber Attack: How a Single Breach Contracted UK GDP

Inside the Jaguar Land Rover cyber incident that shut down production for five weeks, cost GBP 1.9 billion, and triggered the UK's first cyber-related government loan guarantee.

11 min read

Read Guide

Research & Intelligence

The Ivanti VPN Zero-Day: How a Buffer Overflow in a VPN Appliance Breached the UK's Domain Registry

In December 2024, a suspected Chinese state-sponsored group exploited CVE-2025-0282, a critical stack-based buffer overflow in Ivanti Connect Secure, to breach Nominet, the registry responsible for over 11 million .uk domain names. The vulnerability required no authentication. Five days after the patch was released, only 120 of 33,542 exposed appliances had been updated.

13 min read

Read Guide

Research & Intelligence

MuddyWater: How Iran's Intelligence Service Keeps Rebuilding Its Attack Infrastructure

The evolution of MuddyWater's command and control frameworks from Python to Go, how MOIS-linked operators target telecoms and government, and what each framework change reveals about detection pressure.

13 min read

Read Guide

Research & Intelligence

The TfL Cyberattack: How Scattered Spider Stole 7 Million Customer Records Without Disrupting a Single Train

In September 2024, a cyberattack on Transport for London exposed the data of up to 10 million people, cost over GBP 30 million to remediate, and forced 30,000 staff through in-person password resets. Every train kept running.

12 min read

Read Guide

Research & Intelligence

The CrowdStrike Outage: What Actually Happened Inside 8.5 Million Machines

A technical breakdown of the July 2024 CrowdStrike outage. How a configuration file triggered a kernel-level crash, why recovery took 10 days, and what your business should learn from it.

10 min read

Read Guide

Research & Intelligence

The Synnovis Ransomware Attack: How One Pathology Provider Took Down Six NHS Trusts

On 3 June 2024, Qilin ransomware hit Synnovis, a private pathology provider. Within hours, blood testing collapsed across south-east London. 10,152 appointments postponed, one patient death confirmed, and a national blood shortage declared.

13 min read

Read Guide

Research & Intelligence

The Snowflake Customer Breaches: How Stolen Passwords From 2020 Gave Two Hackers Access to 165 Organisations

In May 2024, a financially motivated threat group called UNC5537 used credentials stolen by infostealer malware to access Snowflake customer instances belonging to 165 organisations. Snowflake itself was not breached. Every compromised account lacked multi-factor authentication. The campaign led to data theft affecting hundreds of millions of individuals, including nearly all AT&T wireless customers.

13 min read

Read Guide

Research & Intelligence

The MOD Payroll Breach: How a Government Contractor Exposed 272,000 Military Personnel Records

In May 2024, a breach of the UK Armed Forces payroll system exposed names, bank details, and home addresses of up to 272,000 serving personnel, reservists, and veterans. The system was operated by third-party contractor SSCL, a subsidiary of French IT firm Sopra Steria. The contractor discovered the breach approximately three months before notifying the government.

12 min read

Read Guide

Research & Intelligence

The Change Healthcare Attack: How Stolen Credentials and a Missing MFA Config Exposed 190 Million Patient Records

In February 2024, the ALPHV/BlackCat ransomware group used stolen credentials to access a Change Healthcare Citrix portal that lacked multi-factor authentication. Nine days of lateral movement led to ransomware deployment, a USD 22 million ransom payment, and the largest healthcare data breach in US history, affecting approximately 190 million individuals.

11 min read

Read Guide

Research & Intelligence

Southern Water and Black Basta: How 750 GB of Personal Data Left a UK Utility

Black Basta stole 750 GB from Southern Water in January 2024, including National Insurance numbers and passport scans. Here is what happened, what it cost, and what would have reduced the damage.

12 min read

Read Guide

Research & Intelligence

The County Mayo Water Hack: How a Default Password Took 180 Homes Offline

In December 2023, an IRGC-affiliated group called CyberAv3ngers compromised a Unitronics PLC controlling a water supply in rural Ireland. The default password was 1111. 180 homes lost water for two days.

12 min read

Read Guide

Research & Intelligence

The MOVEit Breach: How SQL Injection Gave Cl0p Access to 2,773 Organisations Without Deploying Ransomware

In May 2023, the Cl0p ransomware group exploited a SQL injection vulnerability in Progress Software's MOVEit Transfer to steal data from 2,773 organisations affecting 95.8 million individuals. No ransomware was deployed. No files were encrypted. The entire operation was pure data theft and extortion.

12 min read

Read Guide

Research & Intelligence

The 3CX Supply Chain Attack: How North Korea Turned One Employee's Download Into 600,000 Compromised Installations

In March 2023, the Lazarus Group compromised the 3CX desktop application through a cascading supply chain attack that began with a trojanised trading platform downloaded by a single employee. This was the first documented case of one supply chain attack triggering another.

12 min read

Read Guide

Research & Intelligence

The Okta Breach: How Teenagers With Commodity Tools Compromised an Identity Provider Serving Thousands

In January 2022, the Lapsus$ group compromised a third-party support contractor to access Okta's internal systems. The breach exposed the architectural risk of centralised identity providers and the supply chain trust problem that most organisations still haven't solved.

12 min read

Read Guide

Research & Intelligence

Log4Shell: The Logging Library That Could Execute Arbitrary Code

How a feature in Apache Log4j became CVE-2021-44228, scored CVSS 10.0, and exposed the fact that most organisations had no idea what software they were running.

12 min read

Read Guide

Research & Intelligence

The Kaseya VSA Attack: How REvil Turned One Vulnerability into 1,500 Ransomware Infections

A technical breakdown of the July 2021 Kaseya VSA supply chain attack. How REvil exploited an authentication bypass in managed service provider software to deploy ransomware to 1,500 businesses simultaneously, and why the FBI sat on the decryption key for 19 days.

13 min read

Read Guide

Research & Intelligence

The HSE Ireland Ransomware Attack: Eight Weeks of Missed Signals

How Conti ransomware encrypted 80% of Ireland's health service IT estate after eight weeks of undetected lateral movement, and what the PwC post-incident review found.

12 min read

Read Guide

Research & Intelligence

The Colonial Pipeline Attack: How a Single VPN Password Shut Down 5,500 Miles of Fuel Supply

In May 2021, a compromised VPN credential with no multi-factor authentication gave DarkSide ransomware operators access to Colonial Pipeline's IT network. The company shut down 5,500 miles of pipeline carrying 45% of the US East Coast's fuel as a precaution. The ransomware never reached the operational technology.

12 min read

Read Guide

Research & Intelligence

The Exchange ProxyLogon Attack: How Four Zero-Days Gave HAFNIUM Access to 250,000 Servers

In March 2021, the HAFNIUM threat group exploited four zero-day vulnerabilities in Microsoft Exchange Server to compromise over 250,000 servers worldwide. The attack chain turned a single server-side request forgery into full remote code execution without any authentication. Multiple governments attributed the campaign to China's Ministry of State Security.

13 min read

Read Guide

Research & Intelligence

The NotPetya Attack: How a Tax Software Update Destroyed $10 Billion in 90 Minutes

NotPetya was a wiper disguised as ransomware, deployed through a supply chain compromise of Ukrainian tax software MeDoc. It combined EternalBlue, credential harvesting, and irreversible encryption to cause more than $10 billion in global damage. Full technical breakdown of the supply chain vector, propagation mechanics, and why paying the ransom was impossible by design.

15 min read

Read Guide

Research & Intelligence

The SolarWinds SUNBURST Attack: How Clean Source Code Produced a Backdoor

How Russian intelligence poisoned SolarWinds' build system to inject a backdoor into 18,000 organisations while the source code remained untouched, and what the three-component attack chain reveals about supply chain trust.

12 min read

Read Guide

Research & Intelligence

The WannaCry Ransomware Attack: How a Kill Switch Stopped a Global Worm

How WannaCry infected more than 200,000 computers in 150 countries, disrupted 81 NHS trusts, and was stopped by a researcher who registered a domain name. Full technical breakdown of EternalBlue, the 59-day patch gap, and what the NAO investigation found.

13 min read

Read Guide

Ready to Get Certified?

Book your Cyber Essentials certification with our IASME-accredited team. 12-hour fast track available.

Book Certification Take Readiness Quiz