Cyber Essentials UK: the complete guide for small businesses in 2026
Cyber Essentials is the UK government-backed security certification most SMBs will eventually need — here is everything a small business needs to know about it in 2026.
Read more →Blog
Security insights & updates
Practical security advice, product updates, and guides for IT consultants and business owners.
What is Cyber Essentials certification and how do you get it?
Cyber Essentials certification is a UK government-backed scheme that verifies your business has basic security controls in place — here is what it involves and how to apply.
Read more →Cyber Essentials requirements: what your business actually needs to have in place
Cyber Essentials has five specific technical requirements covering firewalls, configuration, access control, malware protection, and patching — here is what each one means in practice.
Read more →GDPR and website security: what UK businesses are actually required to do
GDPR requires appropriate technical security measures to protect personal data — here is what that means in practice for a UK small business website in 2026.
Read more →What is a CAA record and why does your domain need one?
A CAA record controls which certificate authorities are allowed to issue SSL certificates for your domain — without one, anyone can request a certificate for your domain name.
Read more →What is an SSL certificate and how does it actually work?
An SSL certificate is what puts the padlock in your browser and encrypts the connection between your website and its visitors — here is what it does, why it matters, and what happens when it expires.
Read more →Website security for small businesses: where to actually start
Most security advice for small businesses starts in the wrong place — here is a practical, prioritised starting point for a business with no IT team and no security background.
Read more →What is Cyber Essentials Plus and do you need it?
Cyber Essentials Plus is the independently verified version of Cyber Essentials — here is what the extra assessment involves, who needs it, and whether it is worth the additional cost.
Read more →External vs internal vulnerability scanning: which one does your business actually need?
External and internal vulnerability scanning find different things — here is what each one covers, where they overlap, and which is the right starting point for a UK small business.
Read more →What is a Content Security Policy and does your website need one?
A Content Security Policy header tells browsers exactly what your website is allowed to load, closing off a class of attacks that most small business sites have no protection against.
Read more →How to read a vulnerability scan report without a security background
A vulnerability scan report is only useful if you can understand what it is telling you — here is how to read one, prioritise what matters, and know what to fix first.
Read more →DMARC p=none is not protecting you. Here is what it actually does
A DMARC record set to p=none passes every checker but stops nothing — here is what the policy setting means and why it matters for your domain security.
Read more →Cyber Essentials for ecommerce: what online stores need to know before applying
Ecommerce businesses face specific Cyber Essentials considerations around payment pages, customer data, and third-party integrations that other businesses do not.
Read more →Running software that no longer gets updates? Cyber Essentials will flag it
Cyber Essentials requires businesses to use only software versions that still receive security updates — end-of-life software is one of the most common gaps assessors find.
Read more →Cyber Essentials gives you 14 days to apply updates. Most businesses take much longer
Cyber Essentials requires software and security updates to be applied within 14 days of release — here is why that deadline exists and how to actually meet it.
Read more →If anyone can install anything on a work laptop, you have already failed this control
Cyber Essentials asks whether you restrict what software can be installed on devices, because unrestricted installation rights are one of the most common ways malware gets a foothold.
Read more →That USB drive on your desk might be the easiest way into your business
Cyber Essentials asks whether you restrict USB drives and removable storage, because plugging in an unknown device bypasses almost every other security control you have.
Read more →Your anti-malware is only as good as its last update
Cyber Essentials asks whether anti-malware is set to update automatically, because outdated protection can pass a visual check while missing every new threat.
Read more →Is anti-malware installed on every device, or just the ones IT remembered?
Cyber Essentials asks whether anti-malware is installed on all devices in your organisation, and the gaps usually show up on the devices nobody thinks of as company equipment.
Read more →Does everyone at your company have access to everything? Cyber Essentials wants to know why
Restricting user accounts to only what staff need for their job is a core Cyber Essentials control, and most small businesses grant far more access than necessary by default.
Read more →Ex-employee still has access to your systems? Here is why that fails Cyber Essentials
Removing access immediately when staff leave is a Cyber Essentials requirement, and forgotten logins are one of the most common gaps assessors find.
Read more →Using your normal login for admin tasks? That is a Cyber Essentials fail waiting to happen
Cyber Essentials requires administrator accounts to be separate from standard user accounts, and most small businesses skip this without realising why it matters.
Read more →No MFA on your admin login? That is the question Cyber Essentials asks first
Multi-factor authentication on internet-facing services is a core Cyber Essentials requirement, and one stolen password is all it takes without it.
Read more →Three security headers most small business sites are missing, and why they matter
Permissions-Policy, Referrer-Policy, and X-Content-Type-Options headers are commonly missing on UK SMB websites and each closes a different specific gap.
Read more →Cross-Origin headers missing? Most UK business websites have this gap
Missing Cross-Origin-Embedder-Policy and Cross-Origin-Opener-Policy headers leave your site open to a class of browser-based attacks most businesses have never heard of.
Read more →Your DKIM key might be technically present and still fail Cyber Essentials
A 1024-bit DKIM signing key passes basic email checks but fails Cyber Essentials secure configuration standards — here's why key length matters.
Read more →Still using the default password on your office router? Cyber Essentials will catch it.
Cyber Essentials requires you to change every default password on every device, and assessors check this first — here's how to find what you missed.
Read more →Your domain can send phishing emails without your permission. DMARC is the fix.
DMARC stops criminals sending fake emails from your own domain, and most UK small businesses have never checked if theirs is set up correctly.
Read more →I launched a security SaaS at 21. Here is what the first week actually looked like.
One week after launching Olimpio Security — 34k LinkedIn impressions, a first paying customer, industry testimonials, and 100 domains scanned with alarming results. Here is what happened.
Read more →What Happens When Your GitHub Repository Gets Exposed: A Security Guide for Developers
An accidentally public GitHub repository can expose API keys, database credentials, and source code within minutes — here is what to do immediately if it happens, and how to prevent it.
Read more →The Most Common Security Vulnerabilities in UK Small Business Websites (2026)
Based on real scan data from UK small business domains, these are the security vulnerabilities appearing most frequently — and the ones most likely to be sitting undetected on your website right now.
Read more →GDPR and Website Security: What UK Business Owners Need to Know in 2026
UK GDPR requires businesses to implement appropriate technical security measures to protect personal data — here is what that means in practice for your website, and how to demonstrate compliance if the ICO comes knocking.
Read more →What is Cyber Essentials? A Simple Guide for UK Small Businesses
Cyber Essentials is a UK government-backed certification that shows your business takes cybersecurity seriously. Here is what it covers, who needs it, and how to prepare.
Read more →How to Prepare for Cyber Essentials Certification: A Step-by-Step Guide
Preparing for Cyber Essentials certification does not have to be complicated — this step-by-step guide walks through each of the five controls, what assessors check, and how to make sure you pass first time.
Read more →What Is Subdomain Takeover — and Is Your Business at Risk?
Subdomain takeover lets attackers claim an abandoned subdomain of your domain and host their own content on it — making phishing pages, malware, or fake login forms appear to come from your legitimate domain.
Read more →SSL Certificates: What They Are, When They Expire, and What Happens If You Miss It
An expired SSL certificate breaks your website for visitors, triggers Google penalties, and is one of the most easily preventable security failures — here is everything you need to know to stay on top of it.
Read more →What Is a Vulnerability Scan — and Does My Business Actually Need One?
A vulnerability scan checks your domain and infrastructure for security weaknesses before attackers find them — here is what it involves, what it finds, and whether your business should be running one.
Read more →Cyber Essentials vs ISO 27001: Which Does Your UK Business Actually Need?
Cyber Essentials and ISO 27001 are both cybersecurity certifications, but they serve very different purposes and businesses — here is how to decide which one is right for you.
Read more →Website Security Checklist for UK Small Businesses (2026)
A practical 15-point security checklist for UK small business websites — covering the most common vulnerabilities, what to check, and how to fix each one without needing a dedicated IT team.
Read more →API Key Exposure: What It Is, How It Happens, and How to Fix It
A leaked API key can give attackers full access to your cloud services, payment processor, or email platform within minutes of being exposed — here is how it happens and what to do if it happens to you.
Read more →DMARC, SPF, and DKIM Explained: How to Stop Hackers Spoofing Your Email
DMARC, SPF, and DKIM are three DNS records that protect your email domain from being spoofed by attackers — and missing even one of them leaves your business and your customers exposed.
Read more →We Scanned the World's Most Famous Port Scanner — Here's What We Found
We tested Olimpio on scanme.nmap.org — a site built by the team behind Nmap, one of the most recognised security tools in the world. One finding was confirmed. One was a false positive. Here is what we learned from both.
Read more →How to Check if Your Domain Has Open Ports (And Why It Matters)
Open ports on your domain are entry points — and if the wrong ones are exposed, attackers will find them before you do. Here is how to check what your domain is exposing and what to do about it.
Read more →What Is Cyber Essentials? A Plain-English Guide for UK Small Businesses
Cyber Essentials is a UK government-backed cybersecurity certification that helps small businesses protect themselves from the most common online threats — here is everything you need to know about what it covers, who needs it, and how to prepare.
Read more →