Insights
Field notes, write-ups and sharp opinion from the Malwise team. Practical security writing for people who actually have to act on it.
No posts in that topic yet.
Cyber Essentials Plus audit: what happens on the day and how to prepare
Most organisations that delay booking Cyber Essentials Plus are not unsure whether they need it. They are unsure what the day itself involves: who has to be …
How to implement ISO 27001, and how to keep it working afterwards
Most ISO 27001 projects that stall do not stall on the controls. They stall because the scope was wrong from the start, and every decision built on it inherited …
Microsoft 365 security audit: what should actually be checked
Most organisations running Microsoft 365 have never had anyone independent look at how it is configured. The tenant was set up during a migration, by someone …
How much does a penetration test cost in the UK?
Penetration testing costs vary because no two assessments are quite the same. The time required depends on what is being tested, the complexity of the …
DEFCON 658, Def Stan 05-138 and Defence Cyber Certification: what MoD suppliers actually need
A supplier receives a Ministry of Defence (MoD) contract, finds a clause called DEFCON 658, and asks whether Cyber Essentials covers it. No. Cyber Essentials …
Cyber Essentials vs Cyber Essentials Plus
Both levels certify against the same five technical controls. The difference is who checks that the controls are actually in place. Cyber Essentials is a …
How much does a Cyber Security audit cost?
Search for the cost of a Cyber Security audit and you will find almost nothing useful. Page after page explains why audits matter, then asks you to get in …
What happens if you fail Cyber Essentials?
Nobody asks this question casually. It is asked quietly, usually by someone who has read the question set properly for the first time and realised they are less …
Administrator account security: the accounts that matter, wherever they live
Ask an organisation how many administrator accounts it has and you will usually get a number. Ask it to list them and the number changes. The list that comes …
How to stay compliant with Cyber Essentials, not just certified
Certification is the easy part. You answer the questions, an assessor marks them, a certificate arrives, and everyone moves on. What you actually signed up to …
Administrator account security in Microsoft 365: the account attackers actually want
In most small Microsoft 365 tenants, the Global Administrator account is also somebody’s mailbox. It reads email. It opens attachments. It browses the web …
WMIC has been removed from Windows 11. Here is what it was used for, and what replaces it
I used WMIC last week during a client engagement. Something like this, to clear an old redistributable off a batch of machines: wmic product where "name …
Windows hardening: turning vulnerability scan findings into registry fixes
Most vulnerability reports land on a technical team as a list of findings with no obvious action attached. The scanner names the weakness, cites a reference, …
Microsoft 365 Business Premium: the licence is not the configuration
Business Premium is the best value security licence Microsoft sells to small businesses, and the most consistently wasted. The waste is not the customer’s …
CHECK, CREST and The Cyber Scheme: what the badges on a penetration test proposal actually mean
Every penetration testing proposal arrives covered in acronyms, and most buyers nod at them without knowing which ones matter for their situation. Two of them …
Cyber Essentials Plus is not a penetration test, and a penetration test is not Cyber Essentials Plus
Two questions arrive at our door most months, and both come from the same misunderstanding. “We had a penetration test last year, so we should pass Cyber …
What a penetration test report should actually contain
A penetration test is three things: the testing, the report, and the debrief. Buy one without the other two and you have bought an exercise nobody can act on. …
Vulnerability assessment or penetration test? What you are actually buying
Plenty of UK businesses have bought a penetration test and received a vulnerability scan with a cover page. The two are sold interchangeably, priced very …
How long does Cyber Essentials take? The real timeline, start to certificate
Two questions hide in “how long does Cyber Essentials take”, so here are both answers. Getting certified takes anywhere from a few days to three …
Cyber Essentials scope: what is in, what is out, and what gets businesses caught
Scope is the first question of a Cyber Essentials assessment and the one that decides everything after it. Get it right and the rest is housekeeping; get it …
Cyber Essentials renewal: what changes in year two, and when to start
Most businesses treat Cyber Essentials renewal as a formality. It is not. It is a fresh assessment against the requirements as they stand on the day you submit, …
Cyber Security Audits in the UK: what they involve, what they cost, and how to choose one
Most Cyber Security Audits in the UK are bought for the wrong reason and judged by the wrong measure. Bought because a customer demanded a tick in a box; judged …
Cyber Essentials vs IASME Cyber Assurance vs ISO 27001: which one do you actually need?
Most businesses shopping for security certification are answering the wrong question. Not “which standard is best”, because none of them is best. …
How much does Cyber Essentials cost in 2026? An honest breakdown from a certification body
The most searched question about Cyber Essentials is also the one the industry answers worst: what does it actually cost? Most pages on the subject are written …
Microsoft is retiring text-message sign-in codes. Is your business actually ready for passkeys?
Some time after 1 September, people in your business are going to see a new prompt when they sign in to Microsoft 365: register a passkey. Here is the readiness …
Cyber Essentials explained: what it is, what it covers, and how to prepare
Cyber Essentials is the most requested security certification in the UK, and the most misunderstood. Businesses put it off for months believing it demands a …
Malwise is a licensed IASME certification body for Cyber Essentials and Cyber Essentials Plus
Malwise Cyber Ltd is a licensed IASME certification body for Cyber Essentials and Cyber Essentials Plus. In plain terms: Cyber Essentials is the UK …
Half-time 2026: what six months of UK Cyber Security news actually means for your business
Six months into 2026 and the shape of the year is clear. Incidents are up, the law is changing, the government is spending, and attackers have quietly switched …
Your IT provider is about to be regulated: the Cyber Security and Resilience Bill explained for UK businesses
On 10 June 2026, the Cyber Security and Resilience Bill completed its final stages in the House of Commons. A week later it moved to the House of Lords. Royal …
612,000 reasons to take Cyber Essentials seriously: what the 2025/26 breaches survey is really telling directors
The UK Government’s Cyber Security Breaches Survey for 2025/26 came out on 30 April. It is the same survey, run the same way, for the eleventh year …
How to harden Microsoft 365 in 2026: what's changed and what actually matters
Most Microsoft 365 security guides cover the same list. Multi-factor authentication for all users. Block legacy authentication. Configure anti-phishing …
YellowKey: the BitLocker bypass that needs nothing but a USB stick
Turn technical research into a defensive plan. If you need to understand a specific risk in your own environment, start with a defined scope and written …
Conditional Access in Microsoft 365: why it matters and how to get it right
Every Microsoft 365 tenant we audit has at least one Conditional Access policy that is either doing nothing, actively blocking the wrong users, or creating a …
Why businesses fail Cyber Essentials: the five most common mistakes in 2026
Cyber Essentials looks like a checklist. The questions seem straightforward. Yet as a licensed Certification Body reviewing assessments every week, we see the …
What's actually wrong with UK Cyber Security (and why we started Malwise)
There’s a version of Cyber Security that looks impressive and doesn’t work. You’ve probably seen it: the dashboard with seventeen threat …