Why does this matter?
Most businesses fail Cyber Essentials on their first attempt – not because they lack security tools, but because they lack visibility and alignment to the controls.
Common failure points we uncover:
- Users without MFA enabled
- Shared / generic accounts (e.g. reception, finance)
- Unsupported operating systems
- Unpatched vulnerabilities across devices
- Misconfigured Microsoft 365 security
These are not minor issues – they are automatic failures.
What does it cover?
User Access Control
MFA coverage across all systems, Shared and generic account risks, Privileged/admin access exposure, Guest and external access controls. Identify access risks that could lead to unauthorised access or certification failure
Secure Configuration
Full audit of user devices, Unsupported operating systems, Disk encryption status, Local administrator risks. Ensure devices are securely configured and compliant with Cyber Essentials
Patch Management
Missing security updates, High and critical vulnerabilities (CVEs), Application patching, Patch compliance across endpoints. Highlight exploitable vulnerabilities that must be resolved to pass
Firewall Security
Firewall configuration review, Exposure to the internet, Secure remote access controls, Network boundary protection. Prevent unauthorised external access to your systems
Malware Protection
Endpoint protection / EDR coverage, Antivirus deployment and status, Threat protection controls, User exposure to malicious content. Confirm your ability to detect and prevent malware threats
What does the report include?
Executive Summary
Clear overview of your current security posture and risks
Cyber Essentials Readiness Status
Pass / Fail position across all control areas
Full Risk Breakdown
Mapped directly to Cyber Essentials requirements
Vulnerability & Device Analysis
Detailed insight into risks across your estate
Identity & MFA Analysis
Users, admins, and access risks clearly identified
Prioritised Remediation Plan
Step-by-step actions to achieve certification
Why Fourtify?
We deliver real security insight.
What makes us different:
- Consultant-led assessments (not automated tools)
- Combines device, vulnerability, and M365 data
- Built from real Cyber Essentials certification experience
- Delivered by cyber essentials assesors & security specialists
- Clear, actionable outputs — not technical noise