The baseline
Cyber Essentials as your baseline against AI-assisted attacks
Dr Horne called Cyber Essentials the starting point, not the finish line. Smaller businesses can now get a discount on a first certificate.
Last reviewed against National Cyber Security Centre, SecurityWeek and Cyber Security News. Sources
The message
Start here, then scale up
On launching the review, the NCSC's chief executive said organisations should treat Cyber Essentials certification as the starting point and scale up resilience in line with their size, complexity and risk [9]. The NCSC also urges organisations to use existing tools, standards and frameworks that are evidenced to protect against both conventional and AI-powered attacks [1].
The offer
What was announced
The government announced a 75% discount on Cyber Essentials certification for micro, small and medium-sized businesses applying for their first certificate [9]. Infosecurity Magazine reported the resulting cost as between £80 and £125 plus VAT [8]. Check the current terms with the certification body before you apply, as the sources we read are news reports.
Limits
What it does not cover
Cyber Essentials is a baseline. For essential services, the NCSC's patch wave advice points to the Cyber Assessment Framework rather than Cyber Essentials alone [4]. Larger organisations facing elevated threats are pointed to further NCSC guidance on privileged access workstations, cross-domain architecture and threat hunting [4].
Also
The Cyber Resilience Pledge
Reporting says more than 230 businesses have signed the Cyber Resilience Pledge, which the NCSC's advice suggests considering [8].
Why it fits
Controls against known routes
The NCSC's concern is that AI helps attackers use known weaknesses faster, rather than inventing new ones [7]. A baseline of well-understood controls speaks directly to that concern, because it addresses the exposed software, stolen credentials and remote access that responders keep meeting [7]. If you have never been certified, the discount lowers the cost of finding out where you stand.
Continue with what to do or the four routes attackers use.
Keep reading
Read next
Funding
Cyber Shield, the NERV Centre, a National Agentic Security Unit and an AI Cyber Security Centre: what was announced alongside the NCSC warning.
Read the guide
Legacy systems
AI makes known weaknesses in old systems easier to exploit. The NCSC's advice on unsupported technology and the cost of tech on the cheap.
Read the guide
Response plan
The NCSC's priorities include protected backups and rehearsed incident response. How to test yours before AI-assisted ransomware arrives.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC expects ransomware to get faster and cheaper to run. CyPro can help you plan and rehearse your response before an attack and take charge of containment and recovery if one happens.