Is Cyber Essentials Plus a Penetration Test? Where the Assessment Stops

Plenty of businesses finish their Cyber Essentials Plus certification and assume they’re now covered for penetration testing. That’s understandable, because a Cyber Essentials Plus assessment involves an independent assessor, vulnerability scans, and hands-on testing of your devices, which can sound a lot like a pen test; however, in reality, the two are quite different. 

Cyber Essentials Plus technically verifies that five specific security controls are in place, whereas a penetration test tries to find and exploit weaknesses the way a real attacker would. This guide explains what the Cyber Essentials Plus assessor actually checks, what they don’t touch, and when a business needs both.

Overview

No, Cyber Essentials Plus isn’t a penetration test. It confirms that the basic controls you described in your Cyber Essentials self-assessment are genuinely in place, using a fixed set of five test cases. 

It doesn’t attempt to break into your systems, exploit vulnerabilities, or chain weaknesses together, and it doesn’t examine areas such as your web applications or internal network in depth.

That doesn’t make it any less valuable; Cyber Essentials Plus is an excellent baseline and, for many businesses, the right first step. It simply answers a different question from a penetration test.

What Cyber Essentials Plus Is Designed to Do

Cyber Essentials is the UK government-backed scheme, run by the NCSC with IASME as its delivery partner, that sets out five technical controls every organisation should have in place, which are firewalls, secure configuration, security update management, user access control and malware protection.

Standard Cyber Essentials is a verified self-assessment, meaning that you answer a questionnaire about these controls and a director signs to confirm the answers are accurate. Cyber Essentials Plus takes the same controls and adds an independent technical audit, so an assessor checks that what you said is actually true.

Crucially, the scheme was built to protect against the most common, low-effort attacks. The NCSC’s own Cyber Essentials Plus Test Specification describes its first test as checking whether “an internet-based attacker with low skill” could break in. That’s a deliberate and sensible design choice, but it’s a long way from the skilled, persistent attacker a penetration test is designed to simulate.

What the Cyber Essentials Plus Assessor Checks

The Cyber Essentials Plus assessment is built around five test cases, which are set out in version 3.2 of the test specification:

Notably, the device testing is sample-based, and the assessor tests a representative selection of your end-user devices instead of every single one, and the whole assessment has to match the scope you declared in your Cyber Essentials self-assessment.

What changed in 2026?

Version 3.3 of the Cyber Essentials requirements, known as Danzell, applies to assessments started from the 27th of April, 2026, and it tightened several areas that affect Cyber Essentials Plus:

• MFA is now an automatic fail if it’s available but not switched on for a cloud service, and cloud services can no longer be excluded from scope.
• Critical and high-risk updates must be applied within 14 days, and missing that window is also an automatic fail.
• Retesting is stricter. If the device sample fails patching, you must fix the issue across every in-scope device, and the assessor then retests the original devices plus a new random sample. A second failure means you fail Cyber Essentials Plus and your underlying Cyber Essentials certificate is revoked.
• Your self-assessment answers are locked before Plus testing begins, so you can’t change them during the assessment.

These changes make Cyber Essentials Plus certification harder to pass than it used to be, but they don’t change what kind of assessment it is. It’s still a check of the same five controls. If you’re getting ready for one, our guide on preparing for your Cyber Essentials Plus audit covers the practical steps.

Where the Assessment Stops

Because Cyber Essentials Plus checks a fixed list of controls, there’s a lot it never looks at. These are the main gaps between Cyber Essentials Plus and a penetration test.

It finds vulnerabilities but doesn’t exploit them: The assessor’s scans flag known weaknesses and missing patches, but nobody tries to use them to gain access, move through your network or reach sensitive data. A penetration test shows what an attacker could actually do with a weakness, which is often far more revealing than the weakness itself. We explain the difference between scanning and testing in our guide to vulnerability assessments.

It doesn’t test your web applications: Customer portals, booking systems, online shops and other web applications are among the most commonly attacked parts of a business, and their most serious flaws, such as broken access controls or business logic errors, can’t be found by a vulnerability scan. That’s where web application penetration testing comes in.

It doesn’t look at what happens once an attacker is inside: Cyber Essentials Plus checks individual devices for patches and malware protection, but it doesn’t test how far an attacker could get after compromising one of them. Weaknesses in Active Directory, shared credentials, flat networks and excessive permissions are the things that turn a single compromised laptop into a full ransomware incident, and they’re exactly what an internal penetration test looks for. Our guide to external vs internal penetration testing explains how the two views differ.

It only checks one part of your cloud security: The MFA test confirms that sign-ins are protected, but it doesn’t review how your cloud services are configured, who has access to what, or whether sensitive data is exposed.

It doesn’t involve people: Phishing, phone-based social engineering, and physical access are outside the scope of the assessment, which is important to understand since social engineering is the most common form of cyber attack.

Perhaps most importantly, Cyber Essentials Plus is a snapshot of a sample. A clean result tells you that the devices tested on the day met the standard, not that every system in the business is secure. We explore this gap further in Cyber Essentials alone won’t protect you and Cyber Essentials vs cyber resilience.

Cyber Essentials Plus vs Penetration Testing

When You Need Both

Cyber Essentials Plus is often required in its own right, particularly for UK government contracts and in many supply chains, and a penetration test won’t give you that certificate. Equally, Cyber Essentials Plus won’t meet a penetration testing requirement, because the scheme doesn’t include any form of Cyber Essentials penetration testing. Many businesses therefore need both, and the common situations include:

• A compliance standard expects penetration testing. PCI DSS requires it outright, and ISO 27001, SOC 2 and GDPR Article 32 all expect regular testing that goes well beyond a five-control check. Our guide to which compliance standards require penetration testing covers each one.
• A customer, insurer or investor asks for a pen test report. A Cyber Essentials Plus certificate is useful evidence, but it isn’t what they’ve asked for.
• You run web applications or hold sensitive data. If your business depends on a customer-facing platform or holds confidential, financial, or health information, the areas Cyber Essentials Plus doesn’t cover are likely where your biggest risks lie.
• You’ve made significant changes. New systems, a cloud migration or an acquisition can all introduce weaknesses that won’t show up until your next Cyber Essentials Plus renewal, if at all.

How Cyber Essentials and Cyber Essentials Plus Fit Alongside Pen Testing

The good news is that the two work well together. Cyber Essentials Plus ensures the fundamentals are in place, so a penetration tester can focus on harder, more valuable problems instead of reporting missing patches. In the other direction, a penetration test often uncovers configuration issues that could cause you to fail your next Cyber Essentials Plus assessment, giving you time to fix them first.

For a business just starting out, Cyber Essentials followed by Cyber Essentials Plus is a sensible foundation. But if you’ve been treating your certificate as proof you’re secure, remember that any pen test beats no pen test, and a certificate that never changes your testing scope can leave you in the Pentest Trap, confident in a result that only covered part of the picture.

Going Beyond the Certificate with Fortifi

Fortifi is a CREST-accredited penetration testing company, and our UK penetration testing services pick up where Cyber Essentials Plus leaves off, covering web applications, internal networks, Active Directory, cloud environments and more. We work with many organisations that already hold Cyber Essentials Plus and want to understand what an attacker could actually do.

Because we don’t do sales calls, you’ll speak directly to a cyber security expert who can help you work out which areas Cyber Essentials Plus hasn’t covered for your business and scope a test around them. Book a call with our team today.

Cyber Essentials Plus FAQs

Is Cyber Essentials Plus a penetration test?

No. Cyber Essentials Plus is an independent technical verification of the five Cyber Essentials controls, carried out through five fixed test cases. It includes vulnerability scanning but doesn’t attempt to exploit weaknesses, test web applications or assess what an attacker could do once inside your network.

Does Cyber Essentials Plus include a vulnerability scan?

Yes. The assessor carries out an external scan of your internet-facing systems and an authenticated scan of a sample of your devices to check for missing security updates. These scans identify known vulnerabilities, but they don’t replace a penetration test.

Can a penetration test replace Cyber Essentials Plus certification?

No. If a contract or tender requires Cyber Essentials Plus, you need the certificate itself, which is issued through the scheme’s certification bodies. A penetration test can help you prepare, but you can’t use it as a replacement.

Who carries out a Cyber Essentials Plus assessment?

Assessments are carried out by certification bodies licensed through IASME, the scheme’s delivery partner. The assessor must work within the scope of your Cyber Essentials self-assessment and follow the NCSC’s test specification, so the assessment can’t be extended into a full penetration test.

How often do I need Cyber Essentials Plus?

Cyber Essentials Plus certification is renewed annually. Penetration testing is usually carried out at least once a year as well, and again after any significant change to your systems.

What changed for Cyber Essentials Plus in 2026?

The Danzell update, which applies to assessments started from the 27th of April, 2026, made MFA on cloud services and the 14-day patching window automatic fail points, prevented cloud services from being excluded from scope, and introduced stricter retesting, where a second failure revokes the underlying Cyber Essentials certificate.