Cyber Essentials has become a hard gate for UK business. Public sector frameworks demand it, supply chains inherit it, insurers price around it and the updated scheme has real teeth: a single cloud account without multi-factor authentication is now an automatic failure, not a footnote.

As a forcing function for baseline hygiene, it has quietly done more for UK security than a decade of awareness posters.

But somewhere along the way, certification stopped being treated as a floor and started being treated as a verdict. Boards hear “we passed” and file security under solved. That instinct is understandable and wrong in two directions at once.

Assessments photograph a day. Attackers exploit the year.

First, the certificate describes a moment, not a state. Almost every access-control finding an assessor raises is really an identity lifecycle failure: the contractor whose account outlived the contract, the mover who kept every permission from three roles ago, the leaver flagged on Friday and de-provisioned the following Thursday.

Organisations that scramble to tidy accounts each renewal season aren’t managing identity; they’re staging it for the photograph. While joiner-mover-leaver remains a manual, ticket-driven process, the drift back into non-compliance begins the day after the
assessment — the only variable is how far it gets before someone looks.

The fix isn’t heroics before the audit; it’s making the lifecycle event-driven, so compliance becomes a by-product of how identity works rather than an annual performance.

The badge proves the doors lock. Not that anyone is watching.
Second, and less comfortably: the attacks doing real damage to UK organisations no longer break in. They log in. A phished credential, a stolen session token, an MFA-fatigue prompt accepted at 11pm and the intruder is indistinguishable from a colleague. Baseline controls were never designed to see that.

What stands between a compromised login and a ransom note is detection: noticing that a legitimate account has stopped behaving legitimately, fast enough to act. The regulatory direction of travel makes the same point. The UK’s incoming cyber resilience legislation is built around incident reporting on tight timescales an obligation that quietly assumes you can reconstruct what happened, to which accounts, starting when.

Recommended reading

• UK VC Investment Shows Divergence In Early and Late Stage Deals
• UK VC Investment Gathers Pace in Q1 2026
• Report: Appetite for AI Investment Higher Than Manageable for CIOs

That is not a certificate question. It is a question of whether your organisation keeps evidence as a living capability or
attempts archaeology after the fact.

The better question
None of this is an argument against Cyber Essentials but quite the opposite. It’s an argument for reading it correctly: as the entry ticket to a conversation, not the conclusion of one. The organisations getting this right ask two questions instead of one.

Can we prove our controls, continuously and without a scramble? And if a valid credential turned hostile this afternoon, how long before we’d know? A certificate answers neither. The photograph is worth taking but security is the film.

Pratheesh is an IAM solutions expert at ManageEngine UKI. ManageEngine is running demo-led webinar series of this argument this August — Identity Under Control (21–22 Sept) on identity lifecycle automation and Cyber Essentials readiness. Register: Identity Under Control: From Onboarding Chaos to Cyber Essentials Certified