Cyber Essentials, Vulnerability Scanning or Penetration Testing: Which Do You Need?

Four things that sound alike but prove different things

These are not rungs on one ladder where you reach the top and win security. Each answers a different question. Cyber Essentials asks whether you have the basics in place. Cyber Essentials Plus asks whether someone independent can confirm it. Vulnerability scanning asks which known weaknesses are visible right now, and keeps asking. A penetration test asks whether a skilled person, behaving like an attacker, can actually get in.

The summary below is deliberately blunt. Where a published price exists we give it in the next section; where it does not, we say so rather than guess.

• Cyber Essentials. Purpose: show that five basic controls are in place - firewalls, secure configuration, security update management, user access control and malware protection. Method: a verified self-assessment questionnaire, signed off by a board member or equivalent and marked by an assessor. It shows: you have declared, and an assessor has accepted, that your setup meets the standard. It does not show: that your answers have been technically tested, or that you have no weaknesses. Choose it when: you want a recognised baseline, or a customer or tender asks for it.
• Cyber Essentials Plus. Purpose: the same five controls, with independent technical testing to check they work in practice. Method: the same questionnaire first, then a technical audit by a Certification Body, including a scan of each public IP address and checks on a sample of devices. It shows: your declared controls held up under a defined set of tests. It does not show: that a determined attacker cannot get in, because it is a standard test of the baseline rather than an attack on your particular systems. Choose it when: someone you answer to wants independent verification.
• Vulnerability scanning. Purpose: find known weaknesses and failed updates, repeatedly. Method: an automated tool checks the systems you point it at, such as your website and external IP addresses, and reports known issues. It shows: what is exposed and unpatched across that scope, and whether your update process is really working. It does not show: whether a weakness can be used in practice, how issues could be chained together, or anything outside the scope you gave it. Choose it when: you want an ongoing view between audits.
• Penetration testing. Purpose: gain assurance in a system by trying to breach it using the tools and techniques an attacker would use. Method: scoped, human-led testing agreed in advance. It shows: how the tested systems stood up on the day of the test. It does not show: that untested systems are safe, or that things stay safe after the next change. Choose it when: you have a specific system, risk or contractual question that a baseline or a scan cannot answer.

What Cyber Essentials and Cyber Essentials Plus tell a customer

Cyber Essentials is the government-recommended minimum standard of cyber security, developed by the NCSC and delivered through IASME. It is checked through a verified self-assessment. You can do that yourself through IASME or take the supported route with a licensed Certification Body. The NCSC lists the starting price as £320 plus VAT, tiered by organisation size. Check the current fee for your headcount before you budget.

Cyber Essentials Plus uses the same requirements and the same questionnaire, and adds the audit. IASME describes an external scan of each public IP address plus checks on a sample of devices, covering things like supported software, high and critical patches, malware protection, separation of standard and administrator accounts and multi-factor authentication on cloud services. It is quoted individually according to the size and complexity of your network, so there is no single published price. IASME says the Plus audit should be completed within three months of your Cyber Essentials certification; your Certification Body will confirm the timing that applies to you.

Two things changed in 2026 that matter if you last certified a while ago. Version 3.3 of the Requirements for IT Infrastructure took effect on 27 April 2026, with a new question set called Danzell. Cloud services can no longer be left out of scope. Multi-factor authentication is mandatory on cloud services wherever it is available. And high-risk or critical updates must be applied within 14 days of release - failing those questions now fails the assessment outright. Organisations that already had an assessment account before the changeover were given six months to finish under the old version, so assume that window has now closed and plan for the current rules.

One wording point matters when you quote the certificate to a customer. Cyber Essentials says your controls meet a baseline at the point of certification. It does not say you were attacked and held. Neither Cyber Essentials nor Cyber Essentials Plus is a penetration test.

Scanning is a habit; a penetration test is an investigation

The NCSC's own framing is useful here. All systems contain vulnerabilities, so a business needs a process that regularly validates which ones are present and where updates are failing. That is vulnerability management, and it is meant to be business as usual rather than an event. Vulnerability scanning is the practical tool for it.

The NCSC says penetration testing should not be seen as the primary way of finding vulnerabilities. Its main job is to check your own vulnerability assessment and management process, rather like an external audit checks the accounts. A test can only confirm that your systems are not vulnerable to known issues on the day of the test, and a year or more can pass between tests. That gap is exactly what regular scanning fills.

Cost is the other difference. Free options exist for scanning. Police CyberAlarm, a Home Office-funded policing service, offers vulnerability scanning of registered websites and external IP addresses at no cost, alongside optional firewall-log monitoring through its Secure Sensor. It is not a Cyber Essentials certificate and it is not a penetration test; it reports known weaknesses on the addresses you register. A penetration test is scoped and priced for the job, so we would not trust any number quoted without a scope behind it.

If you do commission one, the NCSC advises agreeing the technical boundaries up front, naming a technical contact who can respond at short notice, sharing your current vulnerability assessment so the testers can check its accuracy, and choosing testers who are qualified and experienced for the kind of system you run. The CHECK scheme exists for government, public sector and critical national infrastructure work, so it is not the usual yardstick for a small private business. The decisions about what to fix, and in what order, remain yours - the NCSC is clear that this should not be wholly outsourced to the test team.

Which one fits: four illustrative situations

These are hypothetical examples, not case studies, but they cover most of the questions we expect from small organisations.

• A ten-person office on Microsoft 365 is asked by a customer for 'Cyber Essentials'. Do Cyber Essentials. Read the customer's wording first - if it says Plus, you need Plus. If it says Cyber Essentials, you do not need to pay for the audit as well.
• A firm with a public website and a firewall has no outside requirement but wants to know where it stands. Cyber Essentials gives it a structured baseline, and free scanning of the website and public IP addresses shows what is visible from outside. No penetration test is needed yet.
• A business has built its own customer portal that stores personal or financial data. Cyber Essentials and scanning still matter, but neither examines how your application behaves under attack. This is the classic case for a scoped penetration test, ideally after you have cleared the easy findings from scanning.
• An organisation is about to move services to a new platform or open a new network connection. Review the configuration first, scan the result, and test afterwards if the change introduced something custom or externally exposed. Testing just before you fix the basics wastes the tester's time on problems you could have found yourself.

Using them together without paying for the same thing twice

The useful pattern is a loop rather than a ladder. Cyber Essentials forces the baseline to exist. Scanning tells you when it slips. Plus proves the baseline to someone else. A penetration test challenges the things the baseline never covered. Each stage makes the next cheaper, because a tester who is handed a clean scan history and a working patching process can spend time on genuine problems rather than reporting unpatched software.

Do not use one as a substitute for another. A passed audit does not replace scanning, because it describes a point in time. A scan does not replace a test, because it reports known issues without attempting to break in. And a penetration test does not replace Cyber Essentials, because it covers only what was in scope.

A practical next-step checklist

Work through these in order. The first two are free and often settle the whole question.

1. Find the exact wording of whoever is asking. A customer, insurer or tender may name Cyber Essentials, Cyber Essentials Plus or a penetration test. Do not pay for more than the request needs.
2. List what you actually run: the devices people use, the cloud services you sign in to, and every website and public IP address. That list is your scope for certification and for scanning.
3. Fix the known gaps before assessment. Check multi-factor authentication is on for every cloud service that offers it, that nothing unsupported is still in use, and that high-risk and critical updates are applied within 14 days.
4. Complete Cyber Essentials through IASME or a Certification Body. If Plus is required, arrange the audit promptly so it falls within the window your Certification Body gives you.
5. Start recurring scanning of your internet-facing systems and decide who reads the results and who fixes things. A report nobody reads is just a very polite filing exercise.
6. Commission a penetration test only when you can state what it should answer, such as 'can an attacker reach customer records through our portal?'. Agree the scope in writing, share your latest scan results and set aside time to act on the report.
7. Diarise the next review. Cyber Essentials is renewable annually, and a penetration test describes only the day it was run.

Where we fit, and where we do not

We are not a Cyber Essentials Certification Body, an accredited tester or a penetration-testing provider, and nothing here should be read as saying otherwise. What we do is look at how your systems are actually configured - sign-ins, devices, cloud sharing, servers, backups and websites - explain the findings in plain English and help fix them. That is useful groundwork before certification, scanning or a formal test, and it is not a substitute for any of them.

We also help organisations set up the free Police CyberAlarm service, including optional managed hosting of its sensor, and we can help you read its vulnerability reports. We are independent of the police service and it does not endorse us.