Frequently asked questions

We are a UK-based cyber security provider focused on helping organisations build and prove good security hygiene without drowning in jargon or paperwork.

Our core services include Cyber Essentials (CE/CE+), IASME Cyber Baseline for non-UK organisations, penetration testing, vulnerability scanning, Cyber Security Talks, our flagship Cyber Security Audit, and an ongoing vCISO (virtual CISO) service for total security management.

In simple terms: we show you where you stand, help you get certified where needed, and give you a practical plan to manage risk over time.

We typically work with organisations from around 20 people up to several thousand, across sectors such as professional services, healthcare, charities, manufacturing, education and technology.

The common thread is that cyber security now matters to your board, regulators, major customers or insurers – and you want clarity, not another tool.

If you’re smaller than this, we can still help with Cyber Essentials and practical guidance, especially if you’re part of a larger supply chain.

No. In most cases we complement your existing IT team, MSP or internal security function.

Your IT team keeps the lights on and delivers day-to-day services. We help set the security direction, define and review controls, carry out independent testing and provide the evidence your stakeholders expect.

For vCISO and ongoing programmes, we work alongside your IT and suppliers so everyone is pulling in the same direction.

Our company is UK-based, and Cyber Essentials is a UK scheme. However, we also support international organisations in two ways:

• IASME Cyber Baseline for organisations outside the UK that need an internationally recognised hygiene certification.
• Testing, talks and advisory work for non-UK entities that sell into the UK or global supply chains.

If you have a mix of UK and non-UK entities, we can combine Cyber Essentials for the UK side with Cyber Baseline for the rest of the group.

We apply the same principles to our own access as we recommend to clients: least privilege, strong authentication and tight logging.

Wherever possible we use read-only accounts, management portals and secure file-sharing. If we do need privileged access (for example, for penetration testing or parts of the Cyber Security Audit), it is agreed up front, tightly scoped and time-bound.

We enter into appropriate confidentiality, data protection and non-disclosure agreements as part of onboarding.

If you know you specifically need Cyber Essentials, Cyber Baseline or penetration testing, we can start there.

If you want a joined-up picture of risk – or are considering ongoing vCISO support – the best starting point is usually a Cyber Security Audit. It gives you an honest, plain-English view of where you stand and a Fix-First Plan that can feed directly into an ongoing programme.

A short scoping call is normally enough to confirm the right next step.

A virtual CISO (vCISO) is an experienced security leader who takes ownership of your cyber programme without being a full-time employee.

Our approach is flexible total security management. Instead of rigid levels, we use a framework and assemble a programme around what you actually need – things like Cyber Essentials, policy management, monitoring, training, vulnerability management, reporting, testing and more.

You get one accountable owner, regular governance and a realistic plan that fits your size, risk and budget.

We follow a simple sequence:

1. Understand your business, risk drivers and existing controls – usually via a Cyber Security Audit.
2. Agree what "good enough" looks like for you over the next 12–24 months.
3. Assemble a tailored programme from components such as vCISO support days, Cyber Essentials/CE+, monitoring, patch and vulnerability reviews, internal reviews, awareness & training, risk management, reporting, pen testing, SIEM, backup testing and more.
4. Set a governance rhythm (for example, monthly or quarterly) and a simple set of KPIs.

We revisit scope regularly as your organisation and risk profile change.

No. We've deliberately moved away from that model.

In practice, real organisations rarely fit neatly into three boxes. Some need lighter governance but more testing; others need intensive policy work and board engagement but don't yet require 24/7 monitoring.

Instead, we quote a custom four-weekly fee based on the agreed scope and how much ownership you want us to take.

We strongly recommend it, because a vCISO programme only works if it's based on a clear picture of where you are today.

The Security Audit provides that baseline and a Fix-First Plan. We can then build your vCISO scope directly from those priorities. If you already have a recent, high-quality assessment from another provider, we'll review that and discuss whether a new Review is still needed.

We agree a governance rhythm that fits your organisation – for example:

• Monthly or bi-monthly operational check-ins with your IT leads.
• Quarterly reviews and reporting for executives or the board.
• Ad-hoc calls and email support for decisions and incidents, within the agreed scope.

You'll have a named vCISO plus access to our wider team where specialist input is needed.

vCISO is primarily about leadership and management, not reselling tools. We'll work with the tooling you already have where it makes sense and recommend changes where needed.

Where specialist capabilities are required – such as SIEM, managed detection and response or specific backup products – we can:

• Help you select and implement appropriate tools.
• Coordinate with third-party providers, including 24/7 SOC services where required.

Tooling and third-party services are usually billed separately from our vCISO fee.

vCISO is billed as a fixed fee every four weeks. The fee reflects:

• Your size, complexity and regulatory environment.
• How much responsibility we take vs your internal team or MSP.
• The components included (for example, testing, training, monitoring, reporting).

We'll always walk through the scope line-by-line before you commit, so you know exactly what's included.

IASME Cyber Baseline is a certification that demonstrates basic but critical cyber security controls for organisations outside the UK. It maps to several international hygiene standards and is designed to be recognised by global and UK supply chains.

Cyber Essentials, by contrast, is a UK government scheme for organisations operating in the UK. Cyber Baseline fills a similar role for non-UK entities.

Cyber Baseline is aimed at organisations that are based outside the UK but:

• Supply products or services into UK or international markets.
• Need to prove basic cyber hygiene to customers, investors or partners.
• Want a recognised step towards IASME Cyber Assurance.

If you are UK-based, Cyber Essentials is usually the minimum recommended standard instead.

In almost all cases, no – if you are UK-based, Cyber Essentials is the recommended minimum standard and is more widely recognised in UK supply chains.

Cyber Baseline is intended for organisations outside the UK. For groups with mixed entities, we can help you combine Cyber Essentials for UK operations with Cyber Baseline for non-UK entities so you have a consistent story across the group.

Cyber Baseline is primarily about basic hygiene. It aligns with controls that appear in other standards and frameworks, making it a useful stepping stone.

For organisations that later want to move to IASME Cyber Assurance or align more closely with frameworks such as ISO 27001 or NIST CSF, Cyber Baseline helps establish the fundamentals and creates useful documentation and evidence.

The experience is similar in spirit to our Cyber Essentials work:

• We explain the requirements in clear, non-technical language.
• You get remote support from an assessor to interpret questions and understand what evidence is needed.
• We carry out a review before anything is formally submitted, so issues can be addressed proactively.

The exact evidence and controls required will depend on your environment and the latest IASME scheme documents.

Vulnerability scanning uses automated tools to look for known weaknesses in your systems – missing patches, outdated software versions, misconfigurations and similar issues.

It's important because new vulnerabilities are discovered constantly. Regular scanning helps you spot and prioritise issues before attackers do, and demonstrates ongoing diligence to auditors and insurers.

Patch management tools focus mainly on deploying updates to operating systems and certain applications.

Vulnerability scanners use large databases of known issues and test for them directly – including configuration weaknesses, missing hardening steps and third-party components your patch tooling may not cover.

Together, they provide a stronger picture: one helps apply fixes; the other helps prioritise and verify them.

Frequency depends on your risk profile and regulatory environment, but common patterns include:

• Monthly internal and external scans for core systems.
• Additional scans after major changes or new deployments.
• More frequent scanning (for example, weekly) for high-risk or internet-facing environments.

We'll help you agree a schedule that balances risk, effort and noise.

Raw scanner output can be overwhelming. We provide prioritised, human-readable reports that highlight:

• Which issues are most urgent and why.
• What can probably wait for a future cycle.
• Where there are recurring themes that may need a process change, not just one-off fixes.

We can also walk through results with your IT team or MSP so they're clear on what to tackle first.

Think of vulnerability scanning as regular health checks and penetration testing as a detailed medical examination.

Scanning gives you frequent, broad coverage of known weaknesses. Pen testing goes deeper and looks at how issues could be chained together in real attack paths.

We often combine both: regular scanning for hygiene, and scheduled pen tests for higher-risk systems or before major launches.

The quickest way is to contact us with a short description of:

• Your organisation type and approximate size.
• Which service(s) you're interested in (for example, Cyber Essentials, pen testing, Cyber Security Audit, vCISO).
• Any deadlines or drivers (for example, a tender, insurance renewal or audit).

We'll usually suggest a brief call to clarify scope and then send a written proposal with clear inclusions.

Some services, such as Cyber Essentials certification and the Cyber Security Audit, are offered on a fixed-fee basis once we understand your scope.

Others, like vCISO programmes and certain testing engagements, are more variable. In those cases we provide a custom quote based on your size, complexity and the level of ownership you want from us.

We'll always be upfront about what is and isn't included so there are no surprises.

The Cyber Security Audit is typically billed as a fixed fee, with options such as:

• 50% on engagement and 50% on delivery, or
• three staged payments over the Review period.

vCISO programmes are billed every four weeks at the agreed fixed rate. For longer-term relationships we can discuss notice periods and review points that suit both sides.

Generally, no – our fees cover our expertise, time and management. Tooling and third-party services (for example, SIEM platforms, backup products or 24/7 SOC providers) are usually billed separately.

We're happy to work with tools you already own, help you select new ones where needed, and coordinate with other providers as part of your programme.

Scope changes do sometimes happen – for example, adding extra systems to a pen test or increasing the number of sites in a vCISO programme.

Where changes are material, we'll discuss them with you in advance and agree how they affect timelines and fees before proceeding. Minor adjustments are usually absorbed into the existing engagement.