Cyber Essentials certification

Most security quotes begin with a conversation and end with a list of products you're asked to trust. Ours begins with a scan.

We built our own audit software, ShadowAudit, because the tools we could buy either cost more than our clients' entire IT budget or produced hundred-page reports nobody reads. It checks fifteen configuration controls on every Windows machine, finds the devices on your network that nobody remembers plugging in, and looks at your business from outside to see what the internet can reach.

Every finding carries the evidence that produced it. Not "your password policy is weak" but net accounts: minimum length 0, and the setting that fixes it. You can check our work, and so can anyone you hire after us.

How an audit actually runs

First we look from outside. Before we visit, we scan what your business publishes to the internet from our own systems. Open ports, certificate problems, forgotten subdomains, mail records that let anyone send email as you. This is the half most firms have never had checked, and it's the half an attacker starts with.

Then we look from inside. On site, we check each Windows machine against the same fifteen controls: patching, encryption, firewall, antivirus, account policy, legacy protocols. We sweep the network and list every device on it. That list alone tends to produce a surprise or two.

Then you get a report you can act on. Findings ordered by what an attacker would use first, each with the fix, the effort involved, and what breaks if it's applied carelessly. Written for whoever signs things off, not for an engineer.

See a sample report (PDF)

The paperwork, before anything runs

We do not touch a system without written authority. The free perimeter check takes one signed form. A paid audit takes three: the engagement letter, a scope schedule naming every machine we may look at and everything we may not, and a data processing agreement covering the personal data an audit inevitably sees.

All four are published on our downloads page, blank and in full. Read exactly what you would be agreeing to, and what we are promising not to do, before you speak to anyone here.

Read the authorisation forms

Read the case study: 1,241 password attempts in a day on our own server

What it costs

Prices exclude VAT. The IASME certification fee is set by the scheme and paid separately, from £300 + VAT depending on your size. We're not a certification body, so that fee never comes to us.

What it won't do

Worth being straight about, because plenty of firms aren't.

It isn't a penetration test. Nothing we run exploits anything, guesses a password or tries to break in. It's a configuration and exposure audit. If you need someone to actively attack your systems, that's a different engagement with a signed scope, and we'll tell you so rather than dress this up as one.

The Cyber Essentials mapping is readiness, not certification. We tell you whether you'd pass. The certificate is issued by an IASME-accredited body once the questionnaire goes in, and we handle that submission for you.

It won't find everything. Nothing does. It checks Windows machines properly and treats printers, phones and network kit as devices with open ports rather than auditing them internally. We say that in every report rather than letting a clean page imply more than it should.