Skip to main content

Cyber Essentials

Not sure where to start? Take the Danzell test
CE Hub
CE Basic Options
CE Plus Options
Book Certification

Get Certified →

Offensive

Web App Testing
Network Infrastructure
API Security
Mobile Security
Social Engineering
Wireless Assessment
Secure Code Review
Methodology
Pricing

Defensive

Cyber 365
CE+ Assured Programme
24/7 SOC Monitoring
Continuous Vulnerability Scanning
Patch Management

Configuration

Active Directory
Domain Controller
Firewall Review
VPN Review
Cloud Security
ISO 27001

Learn

CE Guide
Basic vs Plus
Self-Assessment Questions
CE Certification
CE Plus Certification

Check Readiness

CE Readiness Quiz
CE Plus Quiz
CE+ Preparation

Get Certified

Not sure where to start? Take the Danzell test
Book Certification
CE Basic Options
CE Plus Options
Bundle Options
Concierge Service
Renew Certification

From £320 + VAT · 12-hour Fast Track assessor reviewBook Now →

Cyber 365

Cyber 365 Overview
Scan + Patch (Base)
EDR Bolt-On
How It Works

CE+ Assured

CE+ Assured Programme
CE+ Pre-Assessment
CE+ Preparation Guide
CE Concierge

Scan. Patch. Certify. · Per-device pricing on a scoping call.See CE+ Assured →

Cyber Essentials
Penetration Testing
Business & Sector
Research & Intelligence

Expert guidesView All →

Community Shield About Trust

020 3026 2904 Contact Us Pentest Quote

Guides

Security Guides.

In-depth guides covering Cyber Essentials updates, compliance changes, and practical security advice for UK businesses.

For non-technical readers: Plain Security Guides

No jargon. No tech background needed. Just the security things everyone should know.

Jump to a Topic Library

Passing Cyber Essentials →

Penetration Testing →

Breach Analysis →

Sector Security →

216 guides

Plain Security Guide

Doesn't the Firewall Block All This?

A firewall controls which doors are open. Almost every modern attack arrives through a door you deliberately left open, which is why it passes straight through.

Plain Security Guide

Do Macs Get Viruses?

Yes, and macOS already includes protection you may not know about. Here is what it covers, what it misses, and whether to add anything.

Plain Security Guide

Does Incognito Mode Make Me Anonymous?

It hides your history from the next person using the device. Your employer, your provider and the sites themselves see exactly as much as before.

Plain Security Guide

How Do I Know If a Website Is Fake?

Read the address, not the page. The padlock proves nothing about honesty, and the polish of a site proves even less.

Plain Security Guide

Is It Safe to Plug In a USB Stick?

A drive you did not buy is a device somebody else configured. Here is what can actually go wrong, and what to do with one you have found.

Plain Security Guide

Is My Cloud Storage Actually a Backup?

Syncing is not backing up. If ransomware encrypts a synced folder, the encrypted version syncs too. Here is the difference and what to do.

Plain Security Guide

Is the Café Wifi Safe, and Do I Need a VPN?

The risk is real but different from what you were told. Here is what actually matters on a shared network, and when a VPN genuinely helps.

Plain Security Guide

Someone Rang Saying They're From Microsoft

Microsoft does not ring about a virus, and your bank will never ask you to move money. Hang up and dial the number you already had.

Plain Security Guide

We've Got Nothing Worth Stealing

They are not after your trade secrets. They are after your payroll run, your mailbox and the machines themselves, which every business has.

Plain Security Guide

Our IT Company Handles Security, Don't They?

Keeping systems running and defending them are different jobs. Five questions that tell you which one you are paying for.

Plain Security Guide

Should I Install That Update?

Yes, if it came from the device itself. No, if it appeared in a browser. That single distinction covers almost every case.

Plain Security Guide

Someone's Left. What Do I Need to Switch Off?

Email is the obvious one and the least of it. Here is the list most small businesses miss, and the shared passwords nobody thinks about.

Plain Security Guide

An Email Says They Have My Password and a Video

It is a mass-sent bluff, and the password came from a data breach. Here is why there is no video, and the one thing worth doing.

Plain Security Guide

What Is Ransomware, in Plain English?

Somebody locks your own files and sells you the key. Here is how it gets in, what actually happens, and the three things that decide the outcome.

Plain Security Guide

Is It Safe to Use WhatsApp for Work?

Encryption is not the issue. Where the records live, who can retrieve them, and what happens when somebody leaves is the issue.

Plain Security Guide

Would I Even Know If I'd Been Hacked?

Probably not, and that is by design. Here is what to actually check, and the handful of signals that genuinely mean something.

Plain Security Guide

Do I Have to Tell Anyone We Were Hacked?

Sometimes yes, and the clock is 72 hours. Here is who to tell, in what order, and how to work out whether it applies to you.

Plain Security Guide

I Clicked a Phishing Link. What Happens Now?

Clicking is usually survivable. What you typed next is the part that matters. Here is what to do, in the order that actually helps.

Plain Security Guide

Is My Password Actually Safe?

Length beats symbols, and reuse beats both. Here is what actually decides whether a password holds, and what to do about the ones you have.

Plain Security Guide

Is That Text From Royal Mail or the Tax Office Real?

Almost certainly not real. Here is the tell that works every time, and the free number that takes the scam text off the network.

Plain Security Guide

Two-Factor Authentication Is Unnecessary Hassle

A strong password is one stolen list away from useless. Here is why the extra step matters, and what the NCSC now recommends instead of it.

Plain Security Guide

My Email Has Been Hacked. What Do I Do?

Work in this order: password, second step, then the hidden forwarding rule almost everyone forgets. That last one is how they get back in.

Plain Security Guide

A Supplier Emailed New Bank Details. Is It Real?

The email is genuine, the invoice looks right, and the account is the criminal's. Here is the one check that catches it, in two minutes.

Plain Security Guide

My Business Is Too Small to Be a Target

Attackers rarely pick you by name. Automated scanning sweeps every business on the internet, and 43% of UK businesses saw a breach last year.

Cyber Essentials

Can Your CE Basic Certificate Be Revoked? What Happens When You Fail CE Plus Under Danzell

Under Danzell, failing the CE Plus second sample scan can revoke your CE Basic certificate too. Here is how revocation works, what it costs, and how to prevent it.

Cyber Essentials

Cyber Essentials Certification Guide: What It Is, What It Costs, and How to Get It

The complete guide to Cyber Essentials certification in the UK. Five controls, two levels, one assessment process. Written by an assessor who's certified over 800 businesses.

Cyber Essentials

Cyber Essentials Plus First-Time Pass: What Danzell Actually Requires

Under Danzell, CE Plus scans must pass first time. No remediation during the assessment. Here is the double sampling process, what triggers it, and how to prepare.

Cyber Essentials

Cyber Essentials v3.3: What the Danzell Update Changes and What You Need to Do

The Danzell update to Cyber Essentials takes effect 27 April 2026. Here is what actually changed in v3.3, what it means for your business, and how to prepare.

Cyber Essentials

Why RMM Scanners and Windows Defender Will Fail Your Cyber Essentials Plus Assessment

RMM tools and Windows Defender are not approved for CE Plus internal vulnerability scans. Here is what the assessment actually requires and why your IT provider's scanner will miss critical vulnerabilities.

Plain Security Guide

Antivirus Is All I Need

Antivirus catches known threats. Most attacks today use phishing, fileless malware, and social engineering that bypass signature-based detection entirely.

Cyber Essentials

Cyber 365: Why Year-Round Vulnerability Scanning Is the New Cyber Essentials Baseline

The Danzell scheme platform that came in April 2026 made year-round vulnerability scanning and managed patching the new Cyber Essentials baseline, not the upgrade. What that operationally means, what it covers, and how the Cyber 365 programme delivers it.

Cyber Essentials

Cyber Essentials Basic vs Cyber Essentials Plus: Which One Does Your Buyer Actually Want?

Cyber Essentials Basic is a self-assessment certificate. Cyber Essentials Plus adds an external assessor sampling the controls in your estate. Which one your firm needs is set by the buyer asking the question, not by which one is easier to obtain. The differences, the costs, the timelines, and how to read the procurement requirement correctly.

Cyber Essentials

Cyber Essentials Plus for NHS Suppliers: DSPT Alignment, Procurement Frameworks, and Patient-Data Confidentiality

NHS suppliers come to Cyber Essentials Plus through three doors: the Data Security and Protection Toolkit, the procurement frameworks NHS England and NHS Trusts run for IT and clinical-systems suppliers, and the patient-data confidentiality obligations under common law and the Caldicott principles. What CE Plus covers, what NHS procurement wants, and how a supplier with a tight contract deadline clears the assessment.

Cyber Essentials

Cyber Essentials Plus for UK Accountancy Firms: ICAEW Standards, HMRC Data, and Client Mandate Cyber Reviews

UK accountancy firms hold HMRC-grade client data on every desktop. ICAEW and ICAS expect effective controls, corporate clients run cyber reviews on their auditors and tax advisers, and PI renewals ask increasingly specific cyber questions. What CE Plus covers, what reviewers want, and how a small partner-led firm with an outsourced MSP clears the assessment.

Cyber Essentials

Cyber Essentials Plus for UK Charities: Trustee Accountability, Funder Requirements, and the Practical Path on a Tight Budget

UK charities face Cyber Essentials Plus from three directions: the Charity Commission's expectation that trustees protect charity assets, funders and grant-makers asking about cyber controls in funding applications, and donor-data confidentiality under UK GDPR. What CE Plus covers, what funders want, and how a charity with a small IT budget actually clears the assessment.

Cyber Essentials

Cyber Essentials Plus for UK Construction: Main-Contractor Flow-Down, BIM Data Protection, and Project-Cyber Requirements

UK construction firms now meet Cyber Essentials Plus through main-contractor supply-chain flow-down, BIM and design data confidentiality on major projects, and the project-by-project cyber requirements that public-sector and large private clients now write into project documentation. What CE Plus covers, what main contractors want, and how a subcontractor or specialist firm clears the assessment.

Cyber Essentials

Cyber Essentials Plus for UK Financial Services: FCA Operational Resilience, Third-Party Risk, and Client Mandate Requirements

FCA-regulated firms now meet Cyber Essentials Plus through three doors at once: operational resilience evidence for the regulator, cyber questionnaires from institutional clients, and increasingly specific PI and crime renewals. What the FCA expects, what the questionnaires want, and how a small in-house IT function clears the assessment.

Cyber Essentials

Cyber Essentials Plus for UK Government Contractors: Central Government Framework, MoD Supply Chain, and OFFICIAL Data Handling

UK suppliers bidding for central government, local government, or MoD contracts now meet Cyber Essentials Plus as a baseline procurement requirement. CCS frameworks, PPN guidance, and Defence Cyber Protection Partnership all name the scheme. What CE Plus covers, what government procurement wants, and how a supplier with a tight bid deadline clears the assessment.

Cyber Essentials

Cyber Essentials Plus for UK Law Firms: SRA Obligations, Client Confidentiality, and Panel Requirements

Law firms come to Cyber Essentials Plus through three doors: the SRA's accountability framework, panel-firm cyber questionnaires from corporate clients, and professional indemnity insurance renewals. What the scheme covers, what the regulator expects, and how a firm with a small IT function actually clears the assessment.

Cyber Essentials

Cyber Essentials Plus for UK Manufacturers: Defence Supply Chain, Tier-1 Customer Audits, and OT/IT Convergence

UK manufacturers come to Cyber Essentials Plus through three doors: defence prime contractors flowing down DEFSTAN and JOSCAR cyber requirements, automotive and aerospace tier-1 customers running supplier cyber audits, and the operational-technology side of the business converging with the IT estate. What CE Plus covers, what tier-1 audits want, and how a manufacturing firm with mixed OT/IT scope clears the assessment.

Cyber Essentials

Cyber Essentials Plus for UK Managed Service Providers: Why MSPs Hold the Certificate Their Customers Are About to Ask For

UK Managed Service Providers sit at the cyber supply-chain boundary for every customer they manage. Customers are now asking the MSP to evidence its own cyber posture before trusting the MSP with theirs. Cyber Essentials Plus is the artefact those customers want. What CE Plus covers for an MSP estate, what customer questionnaires want, and how an MSP whose own house is in disorder gets in shape.

Cyber Essentials

Cyber Essentials Plus for UK Retailers and Hospitality: PCI DSS Adjacency, EPOS Estate, and Brand-Protection Insurance

UK retailers and hospitality operators run a payment-card environment, an EPOS estate across multiple sites, customer-loyalty databases, and supplier-portal integrations. Cyber Essentials Plus closes the cyber-controls section of the PCI DSS conversation, satisfies brand-protection insurance renewals, and answers the procurement questionnaires from B2B clients and suppliers.

Cyber Essentials

Cyber Essentials Plus for UK Schools and MATs: DfE Digital Standards, Safeguarding Data, and the Governor Accountability Layer

UK schools and multi-academy trusts now meet Cyber Essentials Plus through the DfE Digital and Technology Standards, KCSIE safeguarding obligations, and the governor or trustee duty for school resources. What CE Plus covers across MIS, learning platforms, and safeguarding tools, and how a school with a small ICT budget actually clears the assessment.

Cyber Essentials

Cyber Essentials Plus for UK Tech and SaaS Companies: B2B Customer Cyber Reviews, SOC 2 Adjacency, and the Multi-Tenant Cyber Expectation

UK tech and SaaS companies face cyber due diligence from every B2B customer that touches enterprise procurement. SOC 2 attestation is the global default. Cyber Essentials Plus is the UK-anchored evidence that closes the cyber-controls section of UK procurement, opens the door to public-sector contracts, and produces externally-verified evidence of operational cyber discipline alongside the SOC 2 work.

Cyber Essentials

Cyber Essentials Plus vs PCI DSS Self-Assessment: Which Cyber Standard Does Your Card-Handling Firm Actually Need?

Cyber Essentials Plus is the UK government scheme for the IT estate. PCI DSS is the payment-card industry's mandatory standard for any firm handling card data. They cover different scopes and run alongside each other, not as alternatives. The differences, the overlap, and how UK retailers handle both.

Cyber Essentials, Secure Not Just Pass: The Net Sec Group Approach

Most Cyber Essentials providers help you pass the certification. Net Sec Group runs the security operation that keeps the controls in place between certificates. The principle behind why we do it that way, and what end-to-end CE delivery actually looks like for organisations from single-office firms to FTSE 100.

Cyber Essentials

Cyber Essentials vs Cyber Assessment Framework (CAF): Which UK Cyber Standard Does Your Sector Actually Need?

Cyber Essentials is the UK government scheme for general business. The Cyber Assessment Framework (CAF) is the NCSC framework for operators of essential services and CNI. Which one your firm needs is set by sector classification, not by which is harder. The differences, the overlap, and the procurement context.

Cyber Essentials

Cyber Essentials vs NIST CSF: Which Cyber Framework Do UK Firms with US Exposure Actually Need?

Cyber Essentials is the UK government scheme. NIST CSF is the US federal cybersecurity framework. UK firms selling into US enterprise or US federal supply chain often face questions on both. The differences, the overlap, and how to read the requirement correctly.

Cyber Essentials

Cyber Essentials Plus vs SOC 2: Which Cyber Standard Does Your Customer Base Actually Need?

Cyber Essentials Plus is the UK government scheme. SOC 2 is the global SaaS attestation standard. Both prove cyber controls. Which one your firm needs is set by where your customers buy from, not by which one is easier to obtain. The two standards side by side, the cost and timeline reality, and the cases where holding both is the right answer.

Cyber Essentials

The Danzell Question Set Guide: What Changed in the April 2026 Cyber Essentials Update

The Danzell assessment platform replaced Marlin in April 2026, bringing year-round scanning and patching into explicit scope. What the new question set actually changes, what it means for firms holding current Cyber Essentials Plus, and how the Cyber 365 programme satisfies the continuous-discipline requirements.

Cyber Essentials

IASME Cyber Assurance vs Cyber Essentials Plus: Which IASME Tier Does Your Procurement Actually Want?

IASME Cyber Assurance is IASME's audit-based cybersecurity standard. Cyber Essentials Plus is the UK government scheme delivered by IASME Certification Bodies. Both come from IASME. They prove different things. The differences, the procurement context, and the 2026 framework changes.

Cyber Essentials

PPN 09/14 Compliance Guide: How UK Suppliers Meet the Cabinet Office Cyber Essentials Floor

Procurement Policy Note 09/14 set Cyber Essentials as the procurement floor for UK central government suppliers handling personal data or providing certain ICT services. What PPN 09/14 actually requires, where CE Plus fits in the framework, and how UK suppliers satisfy the cyber section of central government bid questionnaires.

Welsh NHS Supplier: From Tuesday Enquiry to Cyber Essentials Plus on Friday

A Welsh NHS supplier had Cyber Essentials Basic, needed Plus by Friday close to satisfy a contract renewal, and the contract was due to be signed Monday. Tuesday call to Friday certificate. The day-by-day shape of how an IASME Certification Body ran the loop end-to-end inside one working week.

Cyber Essentials

Willow to Danzell Migration Guide: What UK Firms Need to Do Between Cyber Essentials Platform Versions

The Willow scheme version led into the Danzell platform from April 2026. What changed between Willow and Danzell, what the migration means for firms holding current Cyber Essentials, and how the Cyber 365 programme bridges the year-round-discipline expectation Danzell now makes explicit.

Cyber Essentials

Willow to Danzell: What to Do If You Have an Open Cyber Essentials Account

IASME retires the Willow question set on 27 April 2026. If you have an open Willow account, here are the deadlines, what happens if you miss them, and what to do next.

Business & Sector

Bank Suppliers and Cyber Essentials: The Six-Bank Commitment and FSQS

Six major UK banks have committed to requiring Cyber Essentials from suppliers. 61% prefer CE-certified suppliers and 33% plan to mandate it. What the banking supply chain commitment means for your business.

Business & Sector

What the Cyber Security and Resilience Bill Means for MSPs

The CSRB brings medium and large managed service providers under NIS regulation for the first time. What it requires, when it takes effect, and what MSPs should do now.

Business & Sector

DEFCON 658: Cyber Essentials Requirements for the Defence Supply Chain

MOD DEFCON 658 requires Cyber Essentials across the entire defence supply chain. CE minimum for all contracts, CE+ for most risk levels. How it works, who it applies to, and what DEF STAN 05-138 means for suppliers.

Business & Sector

Free Cyber Insurance with Cyber Essentials: What You Get and How to Upgrade

Every Cyber Essentials certificate includes free £25,000 cyber insurance. Five major UK insurers use CE as a baseline. Exactly what is covered, the 80% claims reduction, and how to upgrade to £100K or £250K.

Business & Sector

G-Cloud 15: Cyber Essentials Will Be Required for All Suppliers

G-Cloud 15 makes Cyber Essentials mandatory for all supplier lots when it goes live in September 2026. CE+ is required for cloud hosting. What changed and what suppliers need to do now.

Business & Sector

NHS Suppliers: Cyber Essentials and CE+ Are Now Mandatory

NHS supply chain organisations handling patient data must now hold Cyber Essentials and CE+ certification. What changed, who it affects, and how to get certified in under a week.

Business & Sector

PPN 014: Which Government Contracts Require Cyber Essentials?

Procurement Policy Note 014 makes Cyber Essentials mandatory for government contracts involving data or ICT. Which contracts are affected, and what suppliers must do.

Business & Sector

The Full Cyber Security Journey: CE Basic to Pen Testing

From Cyber Essentials Basic at £320 + VAT to penetration testing. The complete path through CE Plus, Cyber 365, and beyond, with pricing at each stage and why each step matters.

Business & Sector

Cyber Essentials Plus in 5 Days: NHS Wales Contractor Case Study

How Net Sec Group delivered Cyber Essentials and CE Plus certification to an NHS Wales contractor in 5 days to meet a contract deadline. The full process from scoping to certification.

Cyber Essentials

How Long Does a Cyber Essentials Plus Assessment Take?

CE Plus testing takes 1-3 days depending on your sample size. But the timeline starts at basic CE and has mandatory windows you can't compress.

Cyber Essentials

Cyber Essentials Plus Assessment Process: What Actually Happens

Five test cases, a sampling methodology, and a 30-day remediation window. What the CE Plus assessment covers and what to expect.

Cyber Essentials

Cyber Essentials Plus Sample Sizes: How Many Devices Get Tested?

CE Plus doesn't test every device. The IASME sampling table determines how many from each OS build, with servers always tested. How the calculation works.

Cyber Essentials

Cyber Essentials Plus Second Sample Rule: What Happens When Your First Scan Fails

The cyber essentials plus second sample rule means a failed scan triggers a second random sample. One 30-day window covers both. Here is how it works.

Cyber Essentials

How to Prepare for Cyber Essentials Plus: What to Do Before the Assessor Arrives

Practical CE Plus preparation from a Lead Assessor. Run your own scans, check MFA works, verify patches on every device, and get your evidence ready.

Cyber Essentials

What Happens If You Fail Cyber Essentials Plus?

What actually happens when a CE Plus assessment finds problems, what the remediation window looks like, and how double sampling works under Danzell.

Cyber Essentials

Cyber Essentials FAQ Database: 327 Questions Answered

Complete Cyber Essentials FAQ covering technical requirements, CE Plus, cloud services, MFA, BYOD, costs, and common failures. Written by a CREST-registered assessor.

Research & Intelligence

The Stryker Attack: When Your Own Device Management Becomes the Weapon

How Iranian-linked hackers weaponised Stryker's Microsoft Intune to wipe devices globally, disrupting medical device manufacturing across 79 countries.

Business & Sector

The 6 Things Cyber Essentials Doesn't Cover

CE covers Protect. Here are the five NIST functions it misses, with real consequences for each gap.

Cyber Essentials

Backup and Recovery: What Cyber Essentials Does and Does Not Require

Cyber Essentials does not require backups. But a ransomware attack without them turns a bad day into a business-ending event. Here is how to think about it.

Penetration Testing

Configuration Review: What It Is and Why It's Part of a Security Assessment

What a configuration review tests, how it differs from a vulnerability scan, and what it reveals about your actual security posture. Written by a CREST-registered pen tester.

Business & Sector

The Cost of Not Having an Incident Response Plan

Synnovis: GBP 32.7M. British Library: GBP 6-7M. Both had security controls. Neither had a tested response plan. What that cost them.

Business & Sector

Cyber 365 for Financial Services: Meeting FCA and DORA Requirements

The FCA expects operational resilience testing. DORA requires ICT risk management. CE covers one function. How Cyber 365 bridges the gap.

Business & Sector

Cyber 365 for Law Firms: Security Beyond Cyber Essentials

The SRA expects more than CE covers. How Cyber 365 maps all six NIST functions to the regulatory requirements law firms actually face.

Business & Sector

Cyber 365 for NHS Suppliers: Beyond CE Plus and DSPT

NHS procurement requires CE Plus. DSPT requires 10 security standards. Both leave gaps. How Cyber 365 maps to the full NHS supplier security expectation.

Business & Sector

Cyber 365: How Our Security Framework Works

Six NIST functions, one programme. How Cyber 365 maps existing services to continuous security coverage.

Cyber Essentials

How to Verify a Cyber Essentials Certificate Is Genuine

How to check if a Cyber Essentials certificate is real, current, and covers the right scope. The IASME register and what to look for.

Business & Sector

Cyber Essentials for Financial Services: FCA, DORA, and Scope

Financial services firms face overlapping regulatory expectations on cybersecurity. Cyber Essentials maps directly to FCA operational resilience rules. How.

Business & Sector

Cyber Essentials for Government Contractors: What You Need to Know

Government contracts involving personal data or IT services require Cyber Essentials certification. Here is what the requirement means and how to meet it.

Business & Sector

Cyber Essentials for Law Firms: SRA Obligations and Client Data

Law firms handle privileged client data daily. Cyber Essentials maps directly to your SRA obligations. What the certification covers and where firms fail.

Cyber Essentials

Cyber Essentials with Legacy Systems: How to Get Certified Without Replacing Everything

How to achieve CE certification when you have unsupported operating systems, legacy applications, or equipment that can't be updated. Sub-scoping, compensating controls, and what assessors actually accept.

Cyber Essentials

How to Display the Cyber Essentials Logo Correctly

Where to put the CE badge on your website, email signatures, and documents. What you can and can't do with the logo, and why the verification link matters.

Cyber Essentials

Cyber Essentials Marking Scheme: How Your Assessment Is Actually Scored

Four outcomes, a two-strike rule, and assessors who cross-reference every answer. How the CE marking scheme works and what trips people up.

Cyber Essentials

Cyber Essentials Password Requirements Under Danzell

What CE requires for passwords and authentication under the Danzell update. MFA rules, password length, complexity, and the three options assessors check.

Cyber Essentials

Cyber Essentials Plus Remote Testing: How It Works

Most CE Plus assessments run remotely now. What the assessor needs, how they verify real devices, and when an on-site visit still makes sense.

Cyber Essentials

Cyber Essentials Remote Working: Controls for Distributed Teams

Home routers become boundary firewalls. Personal phones become in-scope devices. How to implement CE controls when your team works from everywhere.

Cyber Essentials

User Access Control Implementation for Cyber Essentials

How to implement the access control requirements for CE. Admin account separation, MFA, least privilege, and the practical steps that pass assessment.

Business & Sector

Cyber Essentials vs Cyber 365: What's the Difference?

CE covers one NIST function. Cyber 365 covers all six. What each includes, what they cost, and which one your business actually needs.

Business & Sector

Cyber Essentials vs ISO 27001: Which Certification Do You Need?

CE takes weeks and covers five technical controls. ISO 27001 takes months and covers your entire security management system. How to choose.

Business & Sector

Your Managed IT Provider Is About to Be Regulated

The Cyber Security and Resilience Bill brings MSPs into regulation. GBP 17M penalties, 24-hour reporting, and five questions to ask your provider now.

Cyber Essentials

Why Danzell Makes Cyber Essentials Plus Worth Having

Danzell CE+ with whole-org scope, fortnightly scanning, and fortnightly patching is the first time CE has delivered genuine security. This article makes the case.

Cyber Essentials

Danzell Readiness Checklist: Are You Ready for CE v3.3?

A practical checklist covering every change you need to make before the Danzell question set takes effect on 27 April 2026.

Cyber Essentials

DNS Filtering for Cyber Essentials: Does It Count?

DNS filtering is not a Cyber Essentials requirement, but it strengthens your browser security controls and helps block malicious content before it loads.

Business & Sector

Do You Need More Than Cyber Essentials?

CE covers one of six security functions. Whether that's enough depends on what you're protecting, who you report to, and what happens when something gets through.

Cyber Essentials

MFA Edge Cases for Cyber Essentials: What Counts and What Doesn't

Email verification, IP restrictions, Windows Hello, service accounts, shared logins, and session timeouts. Which ones actually satisfy the MFA requirement under v3.3.

Cyber Essentials

Cyber Essentials Plus Vulnerability Scanning: What Gets Scanned, What Fails, and How to Prepare

CE Plus includes internal and external vulnerability scanning by the assessor. This guide covers what devices get scanned, what the assessor looks for, common failure causes, and how to prepare.

Cyber Essentials

Windows 10 End of Life and Cyber Essentials: What It Means If You Haven't Upgraded

Windows 10 support ended 14 October 2025. If you're still running it without Extended Security Updates, you're already failing Cyber Essentials. What to do.

Cyber Essentials

How Long Does Cyber Essentials Take? Realistic Timelines from an Assessor

Honest timelines for CE Basic and CE Plus from a Cyber Essentials Plus Assessor licensed and assured by IASME. Preparation, assessment, and certification timescales.

Cyber Essentials

IASME Certification Process: How Cyber Essentials Assessment Works

IASME is the sole delivery partner for Cyber Essentials. How the certification process works from application to certificate, for both Basic and Plus.

Penetration Testing

Infrastructure Pen Testing: What We Actually Test on Your Network

External scans tell you half the story. Here is what a CREST tester checks on your internal network, servers, and Active Directory.

Business & Sector

Iran Cyber Warning: What CE Covers and What It Doesn't

The NCSC Iran advisory maps to one NIST function. CE covers Protect. What about the other five? Where the gaps are.

Cyber Essentials

Lancaster University Cyber Essentials Study: What the Evidence Actually Says

200 vulnerabilities tested against CE's five controls. 131 fully mitigated, 60 partially mitigated, 9 unmitigated. What that means for your business.

Cyber Essentials

MDM for Cyber Essentials: When It Is Worth It and How to Deploy

MDM is not a Cyber Essentials requirement. But for organisations with more than about 30 mobile devices, it makes compliance easier to prove and maintain.

Cyber Essentials

NCSC Iran Checklist vs Cyber Essentials: Quick-Reference Comparison

Every NCSC recommendation from the Iran cyber advisory mapped against CE controls. What overlaps, what doesn't, and what you need beyond CE.

Cyber Essentials

NCSC Iran Cyber Warning: What UK Businesses Should Do

The NCSC Iran cyber warning maps to Cyber Essentials controls. 149 DDoS attacks logged in 72 hours. Your action checklist follows.

Cyber Essentials

Network Segmentation for Cyber Essentials: What You Actually Need

Network segmentation is not a Cyber Essentials requirement, but it changes what falls in scope. Here is how segmentation affects your assessment.

Business & Sector

NIST Cybersecurity Framework for UK Businesses: A Plain English Guide

NIST CSF 2.0 organises cyber security into six functions. Most UK businesses only cover one. What each function means and why it matters.

Cyber Essentials

Our Cyber Essentials Plus Methodology: How We Run the Assessment

External scans, internal authenticated testing, EICAR verification, MFA checks, and account separation. This is exactly how we conduct CE Plus assessments.

Cyber Essentials

Password Managers and Cyber Essentials: What You Need to Know

Password managers help meet the CE password requirements. Here is how they fit into the User Access Control section and what the assessor expects.

Penetration Testing

Penetration Testing FAQ: What Buyers Actually Ask Us

Straight answers to the questions businesses ask before buying a pen test. CREST, CHECK, cost, timing, and what the report looks like.

Penetration Testing

Penetration Testing: What UK Businesses Need to Know

A pen test is not a scan. This guide explains what penetration testing involves, when you need one, and what to look for in a tester.

Cyber Essentials

Qilin Ransomware and the NHS: How Five Controls Could Have Closed the Front Door

Qilin disrupted NHS blood tests for six months. Their attack used techniques Cyber Essentials is designed to stop. The full kill chain follows.

Cyber Essentials

RDP Security: What CE Assessors Find and How to Fix It

Remote Desktop Protocol exposed to the internet is one of the most common CE failures. Here is what to check and how to secure it.

Cyber Essentials

SMBv1: Why It Needs Disabling for Cyber Essentials

SMBv1 is the protocol WannaCry used. It should be disabled on every machine. Here is how to check and how to fix it.

Cyber Essentials

TLS 1.0 and 1.1: Why They Need Disabling for CE

TLS 1.0 and 1.1 are deprecated protocols with known weaknesses. Here is how to check if they are still enabled and how to disable them.

Cyber Essentials

WinTrust Certificate Padding Check: What It Is and How to Enable It

The WinTrust registry setting prevents tampered executables from appearing legitimate. Here is why CE assessors check it and how to enable it.

Cyber Essentials

Security Awareness Training: What Actually Changes Behaviour

Annual slideshows don't stop phishing. Here is what a CE assessor sees working, and what he sees failing, across the assessments he carries out.

Penetration Testing

Social Engineering Testing: What It Involves and When You Need It

Phishing simulations are one part. Real social engineering testing covers phone calls, physical access, and the human decisions no scanner checks.

Penetration Testing

Types of Penetration Testing: Which One Do You Need?

External, internal, web app, API, wireless, social engineering. Each type of pen test checks different things. This guide explains which ones matter for your business.

Business & Sector

UK Ransomware Payment Ban: What Your Business Can't Do Anymore

The UK government confirmed a ransomware payment ban for public sector and CNI, with a prevention regime for everyone else. What it means for your business.

Penetration Testing

Vulnerability Assessment vs Penetration Testing: What's the Difference?

A vulnerability assessment finds known weaknesses. A penetration test exploits them. Both are useful, but they are not interchangeable.

Business & Sector

What Happens Between Cyber Essentials Certifications?

Your CE certificate lasts 12 months. Your security posture doesn't pause for 364 days. What drifts and what to do about it.

Cyber Essentials

What Vulnerability Scans Find That Auto-Updates Miss

Auto-updates miss third-party applications entirely, and built-in RMM scanners don't catch what an assessor's dedicated scanner finds.

Business & Sector

Why Cyber Essentials Isn't Enough for Your Business

CE covers one of six security functions. The other five are where breaches actually cause damage. What's missing.

Business & Sector

Why Your MSP's 'Managed Security' Isn't Enough

Most MSPs manage your firewall and push patches. That covers Protect. Five of six NIST functions remain unaddressed. What 'managed security' usually means and what it doesn't.

Cyber Essentials

Wireless Security and Cyber Essentials: What the Assessment Covers

Your Wi-Fi network is in scope for Cyber Essentials. Here is what the requirements actually say about wireless security and what catches people out.

Penetration Testing

Active Directory Attacks Explained: What We Find on Internal Networks

Active Directory attacks are among the most common findings on internal pen tests. Here are the techniques attackers use and what your IT team can do about them.

Penetration Testing

Building AI-Assisted Security Assessments

How AI is being integrated into Cyber Essentials and pen testing assessments. What it speeds up, what it can't replace, and where the line sits.

Penetration Testing

10 Cybersecurity Areas AI Is Already Changing

AI is changing how attacks happen and how defences work. Ten areas where it matters now, assessed honestly by a pen tester.

Penetration Testing

AI in Cybersecurity: What's Real, What's Marketing, and What Matters

A pen tester's honest assessment of where AI genuinely changes cybersecurity and where vendors are just rebranding old tools.

Penetration Testing

Can AI Actually Do a Pen Test?

AI tools find known vulnerabilities. Pen testers find the things no scanner checks for. The difference costs money when it matters.

Penetration Testing

API Security Testing: What a Pen Tester Actually Checks

Most API tests are automated scans with a report. Here is what a CREST tester actually checks and why it matters.

Penetration Testing

Automated Compliance Monitoring with Playwright and N8N

How we use Playwright and N8N to automate Cyber Essentials compliance checking. Continuous monitoring instead of annual surprises.

Business & Sector

Boutique vs Large Consultancy: What Actually Differs in Cybersecurity

A boutique cybersecurity firm and a large consultancy both offer Cyber Essentials certification. What actually differs in who does the work, who signs off, and what you pay.

Cyber Essentials

BYOD and Cyber Essentials: What's in Scope and What to Do About It

When personal devices are in scope for Cyber Essentials, what the exceptions are, and practical approaches to BYOD compliance under Danzell.

Penetration Testing

CREST Pen Testing Explained

What CREST certification means for penetration testing, the difference between individual and company accreditation, and why it matters when choosing a tester.

Cyber Essentials

Cyber Essentials 30-Day Preparation Plan

A week-by-week plan to prepare for Cyber Essentials certification. What to fix first, what takes longest, and how to avoid last-minute scrambles.

Cyber Essentials

Cyber Essentials BYOD Policy: Which Personal Devices Are in Scope Under Danzell

A practical cyber essentials BYOD policy guide. Learn which personal devices fall in scope under Danzell v3.3, what's excluded, and how to classify them.

Business & Sector

Cyber Essentials for Charities and Non-Profits

How charities and non-profits can achieve Cyber Essentials certification on a limited budget. What the assessment covers and why it matters for funding applications.

Cyber Essentials

Cyber Essentials Checklist 2026: Full Control-by-Control Guide for Danzell

A printable, control-by-control checklist for passing Cyber Essentials under the Danzell question set from 27 April 2026. Organised by scope, patching, MFA, firewalls, malware protection, secure configuration, and evidence.

Cyber Essentials

The Most Common Cyber Essentials Failures (and How to Avoid Them)

The failure patterns that come up in assessment after assessment. What causes them, how to spot them before your assessor does, and how to fix them.

Cyber Essentials

The Five Cyber Essentials Controls: A Technical Guide

What each of the five Cyber Essentials controls actually requires. Specific settings, thresholds, and configuration details for IT managers.

Business & Sector

Cyber Essentials for Schools and Academy Trusts

Schools and MATs face unique Cyber Essentials challenges: shared devices, outsourced IT, student networks, and legacy MIS systems. How to handle them.

Cyber Essentials

Cyber Essentials for Startups: What You Actually Need

What startups need to know about Cyber Essentials. The five controls, what's in scope when you're small, and why early certification makes contract wins easier.

Cyber Essentials

Cyber Essentials FAQ: The Questions Businesses Actually Ask

Straight answers to the Cyber Essentials questions that come up most often, from scope and cost to MFA, patching, BYOD, and what happens when you fail.

Business & Sector

Cyber Essentials for Healthcare and NHS Suppliers

Healthcare organisations handle special category patient data. Cyber Essentials maps directly to DSPT and NHS supply chain requirements. Where healthcare IT fails.

Cyber Essentials

Malware Protection for Cyber Essentials: What You Need

What the Cyber Essentials malware protection control actually requires. What counts, what doesn't, and the configuration mistakes that cause failures.

Cyber Essentials

Cyber Essentials for Multi-Site Businesses: One Certificate or Many?

How to handle Cyber Essentials when your business has multiple offices. Scope, networking, consistency, and whether you need separate certificates per site.

Cyber Essentials

Cyber Essentials Plus Assessment Guide: What the Assessor Tests and How to Pass

CE Plus is a hands-on technical audit of your systems. Here is exactly what happens, what gets tested, and what you need to do to pass first time.

Cyber Essentials

CE Plus vs CE Basic: What's the Difference?

Self-assessment vs technical audit. What each Cyber Essentials level involves, what it costs, and which one your business actually needs.

Cyber Essentials

Cyber Essentials Renewal: What You Need to Know

How the Cyber Essentials renewal process works, when to start preparing, what changes between assessments, and the most common reasons organisations fail at renewal.

Cyber Essentials

Cyber Essentials Scope Changes Under Danzell: What's Now In Scope

Danzell v3.3 changes what falls in scope for Cyber Essentials. Cloud services can't be excluded, partial scope needs justification, and two qualifiers have been removed from the scope criteria.

Cyber Essentials

Shared Admin Accounts and Cyber Essentials: Why They Fail and How to Fix Them

Shared admin accounts are one of the most common Cyber Essentials failures. What the requirement says, why shared accounts fail, and how to restructure them.

Cyber Essentials

Cyber Essentials Timeline: How Long Certification Takes in 2026

Realistic timelines for Cyber Essentials and CE Plus certification. How long each stage takes, what affects the timeline, and how to avoid delays.

Cyber Essentials

Windows 365 and Contractor Devices: What's in Scope for Cyber Essentials?

How Windows 365 Cloud PCs, contractor devices, and virtual desktops fit into your Cyber Essentials scope. What counts, what doesn't, and where it gets complicated.

Business & Sector

Cyber Insurance and Cyber Essentials: The Full Picture

How Cyber Essentials certification affects your cyber insurance premiums, policy terms, and claims. The UK market context and what insurers actually look for.

Cyber Essentials

Danzell vs Willow: What Actually Changed in Cyber Essentials

Side-by-side comparison of Willow v3.2 and Danzell v3.3 Cyber Essentials requirements. Same five controls. Different scope, definitions, and enforcement.

Cyber Essentials

Failed Cyber Essentials? What to Do Next

What actually happens after a failed CE assessment, why most failures are fixable in days, and how to pass on your next attempt.

Cyber Essentials

Cyber Essentials Plus Assessment Day: What to Expect and How to Prepare

A CE Plus assessment is a technical audit of your systems by an IASME Assessor. What happens on the day, what you need to prepare, and what catches people out.

Cyber Essentials

Cloud Migration and Cyber Essentials: How Moving to the Cloud Changes Your Scope

Moving from on-premise to cloud changes your Cyber Essentials scope in ways most businesses don't expect. What shifts, what stays the same, and where the shared responsibility model trips people up.

Cyber Essentials

Cyber Essentials Cloud Service Inventory: How to Find Everything in Scope

Under Danzell, cloud services can't be excluded from your Cyber Essentials scope. How to find every cloud service your business uses, and what the assessor checks.

Cyber Essentials

Cyber Essentials Compliance Monitoring: Staying Compliant Between Assessments

CE certification lasts 12 months, but compliance can drift in weeks. Here is what to check quarterly and what to fix before renewal.

Cyber Essentials

Contractor Devices and Cyber Essentials: When Are They in Scope?

Contractor laptops accessing your systems are in scope for Cyber Essentials. Here is what controls apply, what options you have, and how to handle the common edge cases.

Cyber Essentials

Cyber Essentials and Incident Response: What the Scheme Covers (and What It Doesn't)

CE doesn't require an incident response plan. But when a breach happens during your certification year, your controls are the first thing that gets checked.

Business & Sector

Cyber Essentials and Insurance: What Your Certificate Actually Gets You

Cyber Essentials certification includes £25,000 free cyber insurance and can reduce premiums by 5-15%. How certification changes your insurance position, from claims handling to coverage terms.

Cyber Essentials

macOS and Cyber Essentials: What Mac Users Need to Know

Macs aren't exempt from Cyber Essentials. How macOS handles each of the five controls, what assessors check, and where Mac environments commonly fail.

Cyber Essentials

Mobile Device App Allowlisting for Cyber Essentials: What You Actually Need

Which mobile devices are in scope for Cyber Essentials, what app controls apply, and how to manage application installation without expensive MDM.

Business & Sector

Cyber Essentials ROI: The Business Case for Certification

Cyber Essentials costs from £320 + VAT. What it saves, what contracts it unlocks, and how to present the business case to your board.

Business & Sector

Why Financial Advisors Need Cyber Essentials

Financial advisors need Cyber Essentials because they handle portfolio data, tax records, and personal details daily. What the certification covers and why it matters.

Cyber Essentials

Firewalls and Antivirus for Cyber Essentials: What's Required

The specific firewall and antivirus requirements for Cyber Essentials. What settings you need, what products work, and where the assessment catches people out.

Cyber Essentials

How Do You Know If You're Ready for Cyber Essentials?

A practical readiness check for Cyber Essentials covering all five controls. What to verify before your assessment so you don't waste time or money.

Penetration Testing

How We Allocate Pen Testing Days

What determines how many days a pen test takes. Scope, assets, methodology, and the questions to ask before you get a quote.

Penetration Testing

The HTTPS Fallacy: Why the Padlock Means Less Than You Think

HTTPS encrypts the connection. It says nothing about who you're connected to. A pen tester explains why the padlock is not a trust signal.

Penetration Testing

How We Recreate Real Vulnerabilities in Our Lab

Most pen testers never show you what they actually find. We recreate real penetration testing findings in a controlled lab so you can see what we look for without exposing client data.

Cyber Essentials

Linux Firewall Configuration for Cyber Essentials

How to configure iptables, nftables, or UFW to meet the CE firewall control. What the assessor checks and how to document it.

Penetration Testing

LLMNR and NBT-NS Attacks: What Your IT Team Should Know

LLMNR and NBT-NS are enabled by default on Windows. Attackers use them to capture password hashes on internal networks. The fix takes minutes.

Cyber Essentials

macOS Firewall Configuration for Cyber Essentials

How to configure the macOS firewall and security settings to meet the CE firewall control. What the assessor checks and how to document it.

Cyber Essentials

MFA on Cloud Services for Cyber Essentials: What v3.3 Requires

Version 3.3 makes MFA mandatory on all cloud services with no scope exclusions. Here is what the requirement says, which services it covers, and what counts as MFA.

Cyber Essentials

Mobile Device Protection for Cyber Essentials

What Cyber Essentials actually requires for phones and tablets. The requirements are simpler than most people think.

Cyber Essentials

Passwordless Authentication and Cyber Essentials: What Counts Under Danzell

How passkeys, FIDO2 keys, and biometrics fit into Cyber Essentials under v3.3. What satisfies the MFA requirement and what doesn't.

Penetration Testing

How Much Does a Pen Test Cost in the UK?

What penetration testing actually costs in the UK and what drives the price. Day rates, scope factors, and how to tell a real test from a rebranded scan.

Cyber Essentials

Local Admin Rights: Why They Fail CE and How to Fix It

Local admin access is one of the most common Cyber Essentials failures. Here is what we find and how to restrict it properly.

Cyber Essentials

PowerShell Execution Policies: What CE Assessors Check

An unrestricted PowerShell execution policy is a CE Plus failure. Here is what the assessor looks for and how to set the right policy.

Cyber Essentials

Software Security Code of Practice: What Changed in Cyber Essentials v3.3

Version 3.3 replaces the OWASP ASVS reference with the UK government's Software Security Code of Practice. Here is what changed, what it means for your CE assessment, and whether you need to act.

Cyber Essentials

Unsupported Software and Cyber Essentials: What to Do When You Can't Update

What happens when in-scope software reaches end of life. The CE rules, your options when you can't update, and how to handle legacy systems during assessment.

Penetration Testing

Web App Pen Testing: What Gets Tested and Why It Matters

Web application testing checks the things your scanner can't see. Authentication flaws, access control gaps, and the business logic mistakes that cost money.

Cyber Essentials

Windows 11 Hardening for Cyber Essentials: Settings That Actually Fail Assessments

Windows 11 defaults won't pass a Cyber Essentials assessment. Autoplay, admin accounts, firewall exceptions, and patch deferral all need fixing. What to change.

Cyber Essentials

Windows Defender Configuration for Cyber Essentials

Windows Defender meets the CE malware protection control when configured properly. Here is what the assessor checks and how to set it up.

Cyber Essentials

Windows Firewall Configuration for Cyber Essentials

How to configure Windows Defender Firewall to meet the CE firewall control. PowerShell commands, Group Policy settings, and what the assessor checks.

Cyber Essentials

Cyber Essentials 14-Day Patching: What the Requirement Actually Says and How to Meet It

The Cyber Essentials 14-day patching rule applies to vulnerabilities scored CVSS 7.0 or above, or described by the vendor as critical or high risk. This guide explains the requirement, what counts as a fix, and how to build a process that keeps you compliant.

Research & Intelligence

The JLR Cyber Attack: How a Single Breach Contracted UK GDP

Inside the Jaguar Land Rover cyber incident that shut down production for five weeks, cost GBP 1.9 billion, and triggered the UK's first cyber-related government loan guarantee.

Research & Intelligence

The Ivanti VPN Zero-Day: How a Buffer Overflow in a VPN Appliance Breached the UK's Domain Registry

In December 2024, a suspected Chinese state-sponsored group exploited CVE-2025-0282, a critical stack-based buffer overflow in Ivanti Connect Secure, to breach Nominet, the registry responsible for over 11 million .uk domain names. The vulnerability required no authentication. Five days after the patch was released, only 120 of 33,542 exposed appliances had been updated.

Research & Intelligence

MuddyWater: How Iran's Intelligence Service Keeps Rebuilding Its Attack Infrastructure

The evolution of MuddyWater's command and control frameworks from Python to Go, how MOIS-linked operators target telecoms and government, and what each framework change reveals about detection pressure.

Research & Intelligence

The TfL Cyberattack: How Scattered Spider Stole 7 Million Customer Records Without Disrupting a Single Train

In September 2024, a cyberattack on Transport for London exposed the data of up to 10 million people, cost over GBP 30 million to remediate, and forced 30,000 staff through in-person password resets. Every train kept running.

Research & Intelligence

The CrowdStrike Outage: What Actually Happened Inside 8.5 Million Machines

A technical breakdown of the July 2024 CrowdStrike outage. How a configuration file triggered a kernel-level crash, why recovery took 10 days, and what your business should learn from it.

Research & Intelligence

The Synnovis Ransomware Attack: How One Pathology Provider Took Down Six NHS Trusts

On 3 June 2024, Qilin ransomware hit Synnovis, a private pathology provider. Within hours, blood testing collapsed across south-east London. 10,152 appointments postponed, one patient death confirmed, and a national blood shortage declared.

Research & Intelligence

The Snowflake Customer Breaches: How Stolen Passwords From 2020 Gave Two Hackers Access to 165 Organisations

In May 2024, a financially motivated threat group called UNC5537 used credentials stolen by infostealer malware to access Snowflake customer instances belonging to 165 organisations. Snowflake itself was not breached. Every compromised account lacked multi-factor authentication. The campaign led to data theft affecting hundreds of millions of individuals, including nearly all AT&T wireless customers.

Research & Intelligence

The MOD Payroll Breach: How a Government Contractor Exposed 272,000 Military Personnel Records

In May 2024, a breach of the UK Armed Forces payroll system exposed names, bank details, and home addresses of up to 272,000 serving personnel, reservists, and veterans. The system was operated by third-party contractor SSCL, a subsidiary of French IT firm Sopra Steria. The contractor discovered the breach approximately three months before notifying the government.

Research & Intelligence

The Change Healthcare Attack: How Stolen Credentials and a Missing MFA Config Exposed 190 Million Patient Records

In February 2024, the ALPHV/BlackCat ransomware group used stolen credentials to access a Change Healthcare Citrix portal that lacked multi-factor authentication. Nine days of lateral movement led to ransomware deployment, a USD 22 million ransom payment, and the largest healthcare data breach in US history, affecting approximately 190 million individuals.

Research & Intelligence

Southern Water and Black Basta: How 750 GB of Personal Data Left a UK Utility

Black Basta stole 750 GB from Southern Water in January 2024, including National Insurance numbers and passport scans. Here is what happened, what it cost, and what would have reduced the damage.

Research & Intelligence

The County Mayo Water Hack: How a Default Password Took 180 Homes Offline

In December 2023, an IRGC-affiliated group called CyberAv3ngers compromised a Unitronics PLC controlling a water supply in rural Ireland. The default password was 1111. 180 homes lost water for two days.

Research & Intelligence

The MOVEit Breach: How SQL Injection Gave Cl0p Access to 2,773 Organisations Without Deploying Ransomware

In May 2023, the Cl0p ransomware group exploited a SQL injection vulnerability in Progress Software's MOVEit Transfer to steal data from 2,773 organisations affecting 95.8 million individuals. No ransomware was deployed. No files were encrypted. The entire operation was pure data theft and extortion.

Research & Intelligence

The 3CX Supply Chain Attack: How North Korea Turned One Employee's Download Into 600,000 Compromised Installations

In March 2023, the Lazarus Group compromised the 3CX desktop application through a cascading supply chain attack that began with a trojanised trading platform downloaded by a single employee. This was the first documented case of one supply chain attack triggering another.

Research & Intelligence

The Okta Breach: How Teenagers With Commodity Tools Compromised an Identity Provider Serving Thousands

In January 2022, the Lapsus$ group compromised a third-party support contractor to access Okta's internal systems. The breach exposed the architectural risk of centralised identity providers and the supply chain trust problem that most organisations still haven't solved.

Research & Intelligence

Log4Shell: The Logging Library That Could Execute Arbitrary Code

How a feature in Apache Log4j became CVE-2021-44228, scored CVSS 10.0, and exposed the fact that most organisations had no idea what software they were running.

Research & Intelligence

The Kaseya VSA Attack: How REvil Turned One Vulnerability into 1,500 Ransomware Infections

A technical breakdown of the July 2021 Kaseya VSA supply chain attack. How REvil exploited an authentication bypass in managed service provider software to deploy ransomware to 1,500 businesses simultaneously, and why the FBI sat on the decryption key for 19 days.

Research & Intelligence

The HSE Ireland Ransomware Attack: Eight Weeks of Missed Signals

How Conti ransomware encrypted 80% of Ireland's health service IT estate after eight weeks of undetected lateral movement, and what the PwC post-incident review found.

Research & Intelligence

The Colonial Pipeline Attack: How a Single VPN Password Shut Down 5,500 Miles of Fuel Supply

In May 2021, a compromised VPN credential with no multi-factor authentication gave DarkSide ransomware operators access to Colonial Pipeline's IT network. The company shut down 5,500 miles of pipeline carrying 45% of the US East Coast's fuel as a precaution. The ransomware never reached the operational technology.

Research & Intelligence

The Exchange ProxyLogon Attack: How Four Zero-Days Gave HAFNIUM Access to 250,000 Servers

In March 2021, the HAFNIUM threat group exploited four zero-day vulnerabilities in Microsoft Exchange Server to compromise over 250,000 servers worldwide. The attack chain turned a single server-side request forgery into full remote code execution without any authentication. Multiple governments attributed the campaign to China's Ministry of State Security.

Research & Intelligence

The NotPetya Attack: How a Tax Software Update Destroyed $10 Billion in 90 Minutes

NotPetya was a wiper disguised as ransomware, deployed through a supply chain compromise of Ukrainian tax software MeDoc. It combined EternalBlue, credential harvesting, and irreversible encryption to cause more than $10 billion in global damage. Full technical breakdown of the supply chain vector, propagation mechanics, and why paying the ransom was impossible by design.

Research & Intelligence

The SolarWinds SUNBURST Attack: How Clean Source Code Produced a Backdoor

How Russian intelligence poisoned SolarWinds' build system to inject a backdoor into 18,000 organisations while the source code remained untouched, and what the three-component attack chain reveals about supply chain trust.

Research & Intelligence

The WannaCry Ransomware Attack: How a Kill Switch Stopped a Global Worm

How WannaCry infected more than 200,000 computers in 150 countries, disrupted 81 NHS trusts, and was stopped by a researcher who registered a domain name. Full technical breakdown of EternalBlue, the 59-day patch gap, and what the NAO investigation found.

Ready to Get Certified?

Book your Cyber Essentials certification with our team, licensed and assured by IASME. 12-hour Fast Track assessor review available.

Book Certification Take Readiness Quiz

Stay Ahead of Cyber Threats

Practical security guidance, threat alerts, and Cyber Essentials updates.

Bletchley Business Campus
Barton Road, Bletchley, MK2 3HU

85 Great Portland Street
London, W1W 7LT

Services

Penetration Testing
Cyber Essentials
Managed SOC
Cloud Security
View all services →

Free Tools

Breach Checker
Cost Calculator
Security Scanner
Free Vulnerability Scan
Free Network Scan
DNS Security Checker
Password Security
Cyber Essentials Pricing
Email Spoof Check
Website Headers Check
Anatomy of a Breach
Case Studies
View all tools →

Cyber Essentials

CE Guide
Book Certification
Hands-Off CE
CE Basic Options
CE Plus Options
Renew Certification

Company

About Us
Trust Centre
Community Shield
Guides
Plain Security
Contact

Secure Your Assets

Ready to assess your security posture? Get in touch for a bespoke penetration test quote.

Request a Pentest

Public Policies

Information Security Statement
Modern Slavery and Human Trafficking Statement
Environmental Policy
Carbon Reduction Plan
Health and Safety Statement
Supply Chain and Subcontractor Policy
UK Sanctions Compliance Statement

Independently Verified Credentials

Verify on the Trust Centre →

© 2026 NET SEC GROUP LIMITED | Company number 12960489

Trust Centre Privacy Policy Terms of Service