Practical guidance on Cyber Essentials, certification and penetration testing — written for business owners, not just IT teams.
9 Sep 2026 · 7 min read
Although the standard does not mandate an annual test, penetration testing can provide valuable evidence that technical vulnerabilities are being identified, assessed and properly managed.
8 Sep 2026 · 7 min read
A penetration test should lead to action, not just a report. Discover what happens after testing, from reviewing findings and prioritising remediation to retesting fixes and improving your wider security.
7 Sep 2026 · 6 min read
An external penetration test may take one to three testing days or longer. Learn what affects the timescale and how to plan for reporting, remediation and retesting.
7 Sep 2026 · 6 min read
Learn what a professional external penetration test report should include, from validated findings and attack paths to remediation priorities and retesting.
7 Sep 2026 · 5 min read
External penetration testing costs depend on the size, complexity and exposure of your internet-facing infrastructure. Learn what affects pricing and how to obtain an accurate quotation.
7 Sep 2026 · 6 min read
How often should you conduct an external penetration test? Annual testing is a sensible baseline, with additional tests after significant changes or cyber incidents.
6 Sep 2026 · 8 min read
A prepared business could achieve Cyber Essentials within days, although security gaps may extend the process to several weeks.
6 Sep 2026 · 8 min read
What affects the cost of Cyber Essentials Plus and how to obtain a clear, fixed-price quotation.
6 Sep 2026 · 6 min read
Why a simple asset inventory helps small businesses secure devices, manage software, control costs and prepare for Cyber Essentials.
6 Sep 2026 · 14 min read
Ten warning signs that could reveal a hidden cyberattack, and the practical steps small businesses can take to detect and respond sooner.
6 Sep 2026 · 12 min read
A practical guide to help small businesses contain a cyber incident, preserve evidence, protect unaffected systems and involve the right people during the crucial first 60 minutes.
3 Sep 2026 · 17 min read
Weak API authentication can allow attackers to bypass login controls, MFA and session protections. Manual testing helps uncover these hidden weaknesses.
29 Aug 2026 · 16 min read
Authentication testing examines login, MFA, password recovery, APIs and session handling to identify practical routes attackers could use to compromise user accounts.
29 Aug 2026 · 16 min read
Small configuration mistakes can expose sensitive data, administrative functions and wider application infrastructure.
29 Aug 2026 · 16 min read
MFA is highly effective, but weak workflows, recovery routes, APIs or session handling can create ways around it.
29 Aug 2026 · 15 min read
SSRF can trick a web application into accessing internal systems, cloud services and sensitive resources on an attacker’s behalf.
29 Aug 2026 · 12 min read
Penetration testing helps schools identify practical weaknesses, protect sensitive information and prioritise security improvements within their budget.
29 Aug 2026 · 11 min read
Five practical signs that changes to your business, systems or customer expectations mean it may be time for a penetration test.
29 Aug 2026 · 10 min read
Learn how Cyber Essentials can strengthen tender responses, simplify supplier checks and give prospective customers greater confidence.
29 Aug 2026 · 11 min read
Discover how the five Cyber Essentials controls reduce common ransomware risks and where additional security measures are still needed.
29 Aug 2026 · 10 min read
How Cyber Essentials helps solicitors, accountants and consultants protect client information, meet requirements and demonstrate security.
28 Aug 2026 · 10 min read
Cyber Essentials Plus helps MSPs support customers’ certification, tender and compliance needs through an independent assessment partner.
28 Aug 2026 · 10 min read
Cyber Essentials Plus independently verifies key security controls, helping organisations build trust, support procurement and demonstrate their commitment to cybersecurity.
28 Aug 2026 · 12 min read
14 days is a compliance limit, not a security target. High and critical vulnerabilities should be fixed as quickly as possible because attackers don't wait.
25 Aug 2026 · 11 min read
LinkedIn can expose valuable business intelligence to attackers. Learn how to reduce the risk of reconnaissance, phishing, impersonation and social engineering.
24 Aug 2026 · 11 min read
Microsoft 365 provides powerful security controls, but they still need to be configured correctly. This article highlights the key security checks SMEs should perform and why regular reviews are essential.
24 Aug 2026 · 6 min read
Employee offboarding involves more than disabling an account. Learn how to remove access, close active sessions and protect company data when staff leave.
24 Aug 2026 · 10 min read
Passkeys provide stronger, passwordless security by using cryptographic credentials that are resistant to phishing and credential theft.
23 Aug 2026 · 11 min read
File uploads are a common but often overlooked web application attack surface. This article explains how insecure upload handling can lead to data exposure, malware distribution, denial of service and potentially code execution.
22 Aug 2026 · 8 min read
Learn how CISA KEV, CVSS, EPSS and asset risk can help businesses prioritise actively exploited vulnerabilities.
22 Aug 2026 · 11 min read
Learn how internal vulnerability scanning works during a Cyber Essentials Plus audit, including device sampling, patch checks and remediation.
22 Aug 2026 · 9 min read
Learn how to prioritise vulnerabilities using CVSS, EPSS, CISA KEV and your organisation’s specific risks.
22 Aug 2026 · 10 min read
Cyber Essentials reduces common cyber risks through five fundamental controls, but it does not replace backups, monitoring, vulnerability management, penetration testing or incident response.
22 Aug 2026 · 5 min read
A backup is only useful if you can actually restore from it. This article explains why SMEs should test their backups, protect them from ransomware, and have a clear recovery plan.
22 Aug 2026 · 9 min read
A practical guide to RMM security for MSPs, covering strong authentication, least privilege, customer segregation, monitoring and regular security testing.
22 Aug 2026 · 9 min read
Active Directory penetration testing identifies attack paths involving credentials, excessive privileges, misconfiguration and lateral movement.
22 Aug 2026 · 6 min read
Automated scanners miss access-control, authentication and business-logic flaws. Learn why web applications also need manual penetration testing.
22 Aug 2026 · 7 min read
An overview of Cross-Site Scripting (XSS), how attackers can inject malicious content into web applications, the risks involved, and how organisations can prevent it.
22 Aug 2026 · 10 min read
Learn how attackers exploit predictable behaviour, weak passwords and password reuse to compromise accounts more efficiently than brute force.
22 Aug 2026 · 6 min read
An overview of SQL injection, how attackers can manipulate database queries, the risks involved, and the key measures organisations can use to prevent it.
22 Aug 2026 · 12 min read
A practical guide to Cyber Essentials Plus for MSPs, covering customer preparation, assessment, remediation and ongoing compliance.
22 Aug 2026 · 9 min read
An internal penetration test reveals how an attacker could escalate privileges, move between systems and compromise Active Directory after gaining network access.
22 Aug 2026 · 9 min read
An external penetration test identifies exploitable vulnerabilities in internet-facing systems and provides practical recommendations to reduce risk.
21 Aug 2026 · 9 min read
Vulnerability scanning finds weaknesses, while vulnerability management prioritises, fixes and continuously monitors them to maintain security throughout the year.
20 Aug 2026 · 6 min read
Broken access control can expose sensitive data and restricted functions. Learn how penetration testing identifies exploitable authorisation flaws.
20 Aug 2026 · 11 min read
A practical guide to web application risks, scanning limitations and how manual penetration testing helps protect applications and customer data.
20 Aug 2026 · 6 min read
An overview of IDOR vulnerabilities, how attackers can bypass access controls to access other users' data, and how organisations can identify and prevent them.
18 Aug 2026 · 11 min read
A practical cybersecurity guide for MSPs, covering privileged access risks, penetration testing, Cyber Essentials and Cyber Essentials Plus.
5 Aug 2026 · 3 min read
20 simple ways to avoid becoming a victim of cybercrime and why Cyber Essentials matters
25 Jul 2026 · 3 min read
Most attacks are not targeted — they are automated, and they find whatever is exposed. We unpick the most common myths that leave smaller businesses at risk.
22 Jul 2026 · 4 min read
A scan and a pentest are not the same thing, and the gap between them is where real breaches happen. Here is what each one does, and when you need which.
19 Jul 2026 · 3 min read
Same five controls, different level of proof. Here is the real difference between Cyber Essentials and Cyber Essentials Plus — and how to choose.
16 Jul 2026 · 4 min read
Cyber Essentials keeps appearing on tenders and insurance forms. Here is what it actually is, what it covers, and why more UK businesses are getting certified.
