A framed certificate hangs in reception, proudly announcing that the business holds Cyber Essentials accreditation. Clients see it and feel reassured immediately. Insurers ask for it before offering cover. Somewhere along the way, though, that certificate has quietly become shorthand for we are secure, when what it actually confirms is considerably narrower, that certain basic technical controls were in place and self-declared correctly on the day the questionnaire was completed, nothing more and nothing less than that.
What a certificate actually checks, and what it does not
Cyber Essentials is a genuinely useful scheme, and the baseline it enforces, covering firewalls, secure configuration, access control, malware protection, and regular patch management, addresses real and common weaknesses seen across countless small businesses. Its value comes precisely from being a floor, a minimum standard every business should clear regardless of size or sector. The confusion arises when that floor gets mistaken for a ceiling, when a business assumes that clearing this baseline means there is nothing more sophisticated left to find or worry about.
A penetration test approaches the same business from a completely different angle, actually attempting to exploit weaknesses rather than confirming that a checklist item has been addressed on paper. Genuine vulnerability scan services tests whether your specific systems, configured exactly as they are today, actually withstand a determined attempt to break in, which is a fundamentally different question from whether a control exists in principle.
The gap between a badge and genuine assurance
The self-assessment version of Cyber Essentials, the most commonly held level, relies substantially on a business answering questions honestly about its own setup, without independent verification of every technical detail behind those answers. That is not a criticism of the scheme, which was designed deliberately to be accessible and affordable for small businesses. It does mean, though, that passing it confirms intentions and stated configuration rather than confirming that a skilled, motivated attacker would actually be stopped by what is in place.
William Fieldhouse regularly meets business owners who are surprised by how much a certificate does not cover.
“A newly certified client asked us to test their systems as a formality, and within a day we had found a way into their customer database using a flaw that Cyber Essentials was never actually designed to look for in the first place.”
— William Fieldhouse, Director of Aardwolf Security Ltd
The client’s surprise was understandable, because nothing about the certification process had been dishonest or poorly conducted. It had simply answered a narrower question than the one they assumed it was answering. Passing Cyber Essentials told them their basic hygiene was in order. It never claimed to have tested their bespoke customer database against a determined, creative attempt to break in, because that was never what the scheme set out to measure in the first place.
Using certification as a floor, not a ceiling
Certification schemes and genuine testing answer different questions, and a business that only ever does the former is measuring itself against a floor while assuming it has checked the ceiling too. Proper best pen testing company fills that gap, showing you what a real attacker would actually find rather than what a self-assessment questionnaire was designed to catch. Holding both together, rather than treating one as a substitute for the other, is what genuine assurance actually looks like.