Many organisations treat Cyber Essentials as the baseline for UK cyber security. For many organisations it is also a commercial requirement: a supplier questionnaire asks for it, a public-sector contract requires it, or a customer wants evidence that basic controls are in place.
But Cyber Essentials is not the same thing as penetration testing.
Cyber Essentials checks whether an organisation has implemented five core technical control areas. Cyber Essentials Plus adds independent technical verification. Penetration testing goes further: it tests how those controls behave under realistic attack conditions, how weaknesses combine, and whether an attacker can actually reach sensitive systems or data.
This guide explains where penetration testing fits around Cyber Essentials, how it supports Cyber Essentials Plus, and when organisations should go beyond certification with a more complete security assessment.
What is Cyber Essentials?
Cyber Essentials is a UK government-backed certification scheme designed to help organisations defend against common internet-based attacks. It focuses on practical technical controls that reduce exposure to commodity threats such as phishing follow-up attacks, password spraying, malware, exploitation of unpatched software, and opportunistic scanning.
The scheme is intentionally focused. It is not a full security audit, a full risk assessment, or a substitute for penetration testing. Its value is in establishing a clear baseline: are the basics in place, consistently applied, and suitable for the organisation’s environment?
The five Cyber Essentials technical controls
Cyber Essentials centres on five technical control areas. A penetration test can provide evidence around each one, but it does so in a different way from the certification questionnaire.
1. Firewalls and internet gateways
Cyber Essentials expects organisations to protect internet-facing services with suitable firewalls, boundary controls, and secure configuration. The assessment looks at whether unnecessary inbound access is blocked and whether administrative interfaces are protected.
A penetration test goes further by actively testing exposed services. That may include identifying forgotten admin panels, weak VPN or remote access configuration, exposed development systems, misconfigured cloud security groups, or services that are technically allowed through the firewall but should not be reachable from the internet.
2. Secure configuration
Secure configuration is about removing unnecessary functionality, changing default settings, disabling unused accounts, and hardening systems so they are not exposed with insecure defaults.
In a penetration test, secure configuration issues often appear as practical attack paths: default credentials, verbose error messages, exposed management interfaces, unnecessary services, insecure TLS configuration, weak application settings, or cloud resources that have been deployed with overly permissive defaults.
3. User access control
Cyber Essentials requires organisations to control access to systems and data, use appropriate account privileges, and limit administrative access.
Penetration testing validates whether those controls hold up in practice. For example, a tester may examine whether ordinary user accounts can access admin functions, whether privilege escalation is possible, whether stale accounts still exist, whether multi-factor authentication is enforced in the right places, and whether application authorisation checks are robust.
4. Malware protection
Cyber Essentials requires appropriate malware protection, which may include anti-malware software, application allow-listing, sandboxing, or other controls depending on the environment.
A penetration test is not a replacement for malware protection, but it can identify routes that malware or an attacker might use after initial compromise. This includes exposed file upload functionality, macro-enabled workflows, weak endpoint controls, excessive user permissions, or systems that allow untrusted code to run without sufficient restriction.
5. Security update management
Cyber Essentials expects organisations to keep supported software up to date and to apply security updates promptly where they address high or critical vulnerabilities.
Penetration testing helps distinguish theoretical patch gaps from exploitable risk. A vulnerability scan may show missing patches; a penetration test can determine whether those weaknesses are reachable, exploitable, and capable of leading to material impact such as account takeover, data access, lateral movement, or service compromise.
Cyber Essentials vs Cyber Essentials Plus
There are two certification levels:
- Cyber Essentials is a self-assessment questionnaire. The organisation answers questions about its environment and controls, and a certification body reviews the submission.
- Cyber Essentials Plus includes independent technical testing. An assessor performs checks against representative devices, internet-facing services, and user systems to verify that the declared controls are working.
Cyber Essentials Plus is more rigorous than the basic certification because it includes hands-on validation. However, it is still scoped around the Cyber Essentials control set. It is not intended to replicate the depth or flexibility of a full penetration test.
How penetration testing supports Cyber Essentials Plus
Penetration testing can support Cyber Essentials Plus in three useful ways.
Pre-assessment readiness
Before a Cyber Essentials Plus assessment, a focused security review can identify issues that are likely to cause problems: exposed services, unsupported software, missing patches, weak device configuration, poor access control, or insecure remote access.
This is especially useful for organisations with complex environments, cloud infrastructure, multiple offices, remote workers, or a mix of corporate and bring-your-own-device patterns.
Evidence that controls work in practice
Cyber Essentials Plus validates baseline controls. A penetration test can add context by showing whether those controls stop realistic attack paths. For example, it can test whether a publicly exposed application can be used to compromise user data, whether cloud misconfiguration exposes sensitive assets, or whether a low-privilege account can be escalated.
Prioritised remediation
Organisations often need to fix certification findings quickly. A penetration test report can help prioritise remediation by impact: which issues are externally exploitable, which affect sensitive systems, which are chained with other weaknesses, and which are hygiene issues with lower immediate risk.
Why Cyber Essentials does not replace penetration testing
Cyber Essentials is valuable, but it is deliberately narrow. It does not fully answer questions such as:
- Can an attacker compromise our web application?
- Can a normal user access data or functions they should not be able to access?
- Are our APIs vulnerable to broken object level authorisation or business logic flaws?
- Can a cloud misconfiguration expose customer data?
- Can an attacker move from one internal system to another?
- Do our controls work against a realistic attack chain?
Penetration testing, application security testing, cloud security assessment, or a targeted security architecture review answers those questions more fully.
For example, a company can pass Cyber Essentials while still having an application-level authorisation flaw that allows one customer to view another customer’s data. That type of issue is not reliably found by a baseline certification process, but it is exactly the kind of weakness a web application penetration test or API penetration test is designed to find.
When should you do penetration testing if you already have Cyber Essentials?
Penetration testing is most useful alongside Cyber Essentials when the organisation has risk beyond baseline IT hygiene. Common triggers include:
- launching a new web application, customer portal, API, or SaaS platform;
- handling sensitive customer, financial, healthcare, or personal data;
- preparing for Cyber Essentials Plus and wanting to reduce assessment risk;
- responding to customer security due diligence;
- supporting SOC 2, ISO 27001, PCI DSS, DORA, NIS2, or other assurance requirements;
- making significant cloud, identity, or network architecture changes;
- needing evidence that security controls work, not just that they are documented.
If the environment is simple, a focused external infrastructure test may be enough. When the main risk sits in a web application or API, application-layer testing is more valuable. If the organisation depends heavily on AWS, Azure, or Google Cloud, a cloud security assessment may be the right next step.
Cyber Essentials, vulnerability scanning, and penetration testing
Cyber Essentials, vulnerability scanning, and penetration testing each answer different questions.
| Activity | Primary question | Typical output |
|---|---|---|
| Cyber Essentials | Are the baseline controls in place? | Certification status and control declarations |
| Cyber Essentials Plus | Do the declared baseline controls pass independent technical checks? | Assessor test results and certification outcome |
| Vulnerability scanning | What known vulnerabilities or exposed services are present? | Automated findings and patch/configuration issues |
| Penetration testing | Can weaknesses be exploited and what is the real business impact? | Validated attack paths, impact, evidence, and remediation guidance |
The most mature approach is not to pick one forever. Use Cyber Essentials as the baseline, scanning for continuous hygiene, and penetration testing for deeper assurance around high-risk systems and changes.
What should a Cyber Essentials-focused penetration test include?
If the goal is to complement Cyber Essentials or prepare for Cyber Essentials Plus, the penetration test should be scoped around the systems that matter most to certification and business risk.
A practical scope may include:
- external attack surface review of internet-facing services;
- testing of VPN, remote access, and administrative portals;
- web application and API testing for customer-facing platforms;
- cloud configuration review for exposed storage, identity, and network controls;
- authenticated testing of important internal systems where appropriate;
- review of patch exposure and exploitable vulnerabilities;
- clear mapping of findings to the five Cyber Essentials control areas.
The report should not just list technical vulnerabilities. It should explain which Cyber Essentials control area is affected, what the practical risk is, what evidence supports the finding, and what needs to be fixed before certification or customer assurance activity.
How Fortbridge can help
Fortbridge helps organisations use penetration testing as practical assurance, not a box-ticking exercise. We can support Cyber Essentials and Cyber Essentials Plus readiness by testing the systems most likely to create certification, customer assurance, or real-world security risk.
Relevant services include web application penetration testing, API penetration testing, network penetration testing, cloud security assessments, and security architecture review.
If you are preparing for Cyber Essentials Plus, responding to a customer security questionnaire, or trying to understand whether your baseline controls actually hold up, we can help you choose a focused scope and produce evidence that is useful to both technical teams and stakeholders.
FAQ
Is penetration testing required for Cyber Essentials?
Penetration testing is not required for the basic Cyber Essentials self-assessment. Cyber Essentials Plus includes independent technical testing, but that testing is focused on the Cyber Essentials control set and is not the same as a full penetration test.
Does Cyber Essentials Plus include penetration testing?
Cyber Essentials Plus includes hands-on technical checks by an assessor. Those checks validate the Cyber Essentials controls, but they are narrower than a penetration test. A full penetration test can examine application logic, exploitability, chained attack paths, cloud configuration, and business impact in more depth.
Should we do a penetration test before Cyber Essentials Plus?
For complex environments, it is often sensible to do a focused readiness test before Cyber Essentials Plus. This can identify exposed services, patching gaps, weak configuration, access control issues, or application risks before the formal assessment.
What is the difference between Cyber Essentials and penetration testing?
Cyber Essentials checks whether baseline controls are in place. Penetration testing validates whether weaknesses can be exploited and what impact an attacker could achieve. Cyber Essentials is a baseline certification; penetration testing is deeper security assurance.
Can Cyber Essentials help with customer security questionnaires?
Yes. Cyber Essentials is a useful signal that baseline controls are in place, especially for UK buyers. For higher-risk customers, regulated sectors, or SaaS providers, a recent penetration test report often provides stronger assurance because it shows that key systems have been actively tested.
About Post Author
