The truth about a “guaranteed” Cyber Essentials pass

“Guaranteed pass” and “100% pass rate” are everywhere in Cyber Essentials marketing. It sounds like a promise of an easy ride. In practice, no honest assessor can guarantee a pass regardless of the state of your controls, and it is worth understanding why.

A guarantee of what, exactly?

Cyber Essentials is a self-assessment, verified by an assessor, against five real security controls. If those controls are not in place, the honest outcome is not a pass, it is help getting ready. So a blanket guarantee can only mean one of two things: either they will do the work to get you genuinely ready, or they will pass you whatever the reality. One of those is a service. The other is a problem.

Why the second version is dangerous

If a provider signs off your submission without properly checking it, you end up with a certificate that says you are secure when you are not. That is dangerous in four concrete ways.

• It does not protect you. The everyday attacks Cyber Essentials is designed to stop can still walk straight in, because the controls were never really there.
• It can unravel when it counts. If a client audits your controls, or your insurer reviews a claim after a breach, a certificate that does not reflect reality can be challenged, and at worst it looks like misrepresentation.
• It breeds false confidence. You believe you are covered, so the real gaps never get fixed and the risk quietly grows.
• It is money wasted. You paid for a badge, not for the protection the badge is supposed to signal.

What an honest “we’ll get you there” looks like

A certified IASME assessor who checks your answers, tells you plainly what to fix first, usually multi-factor authentication and removing unsupported software, explains what each control means, and only signs off what is genuinely in place. That is still fast, especially if you are close. It is just real, which is the whole point of holding the certificate.

Common questions