The Key Failure Points in Cyber Essentials

Cyber Essentials helps organisations protect themselves against common cyber threats, but many businesses still find the assessment more challenging than expected. Understanding where failures typically occur can make preparation easier, reduce avoidable delays and strengthen wider security.

Although Cyber Essentials is often described as “basic cyber hygiene”, organisations are frequently surprised by how easy it is to fail. Most failures do not happen because of sophisticated cyber threats or highly technical mistakes. They happen because of overlooked systems, inconsistent processes and assumptions that security controls are working when they are not.

For many businesses, Cyber Essentials is more than a certification. It is a gateway to government contracts, supply chain partnerships, insurance requirements and customer trust. Failing an assessment can delay projects, create commercial risk and expose weaknesses that leadership teams believed had already been addressed.

The good news is that most failures follow familiar patterns. Once organisations understand where those pressure points sit, preparation becomes significantly easier.

Unsupported Systems Still Lurking in the Business

One of the most common reasons organisations fail Cyber Essentials is surprisingly simple: unsupported software.

An old Windows laptop sitting in a drawer, an outdated Android phone still accessing company email or forgotten firmware on a router can all create problems during assessment. Cyber Essentials requires operating systems, applications and firmware to remain supported and updated by vendors. Unsupported technology is treated as a direct security risk.

This becomes especially challenging in businesses where technology estates have grown organically over time. Legacy applications remain in place because “they still work”, while devices issued years ago continue connecting to modern systems without anyone reviewing them.

The issue is not only visibility. It is ownership. Many organisations simply do not have a clear inventory of what is actually running across the business.

Businesses that perform well in Cyber Essentials assessments tend to approach asset management with discipline. They know what devices exist, who owns them and whether those systems are still receiving security updates.

Patch Management That Exists on Paper but Not in Practice

Many companies believe they have patching under control because automatic updates are enabled somewhere in the environment. However, Cyber Essentials looks beyond assumptions.

Under the scheme, critical and high-risk updates must generally be applied within 14 days of release. Assessors regularly identify organisations where updates have quietly failed for months without anyone noticing.

Third-party applications are often the biggest weakness. Browsers, PDF readers, collaboration tools and utility software frequently fall outside central IT oversight. Over time, these become easy entry points for attackers.

What makes this particularly dangerous is that many organisations rely entirely on automated reporting tools without manually validating results. Dashboards can suggest systems are compliant while real devices tell a very different story.

Strong organisations treat patching as an operational rhythm rather than a quarterly exercise. They verify updates, review failures and ensure exceptions are actively managed rather than forgotten.

Multi-Factor Authentication Gaps

As Cyber Essentials requirements evolve, multi-factor authentication has become one of the clearest dividing lines between compliant and non-compliant organisations.

A common issue is partial deployment. Administrators may use MFA, but standard users do not. Cloud platforms may support MFA technically, yet certain accounts remain excluded for convenience or compatibility reasons. Under newer Cyber Essentials guidance, these gaps can result in immediate failure.

The challenge is often cultural rather than technical. Businesses want security, but they also want frictionless access. Over time, exceptions accumulate until the environment no longer reflects policy.

Organisations that succeed tend to make MFA non-negotiable. They remove shared accounts, enforce authentication consistently and ensure suppliers or third-party services align with the same standards.

Administrator Privileges Everywhere

Another recurring problem is excessive administrative access.

Developers, IT teams and senior staff are frequently granted administrator rights permanently because it feels operationally convenient. Cyber Essentials, however, expects a clear separation between standard user activity and privileged administration.

This matters because compromised administrator accounts dramatically increase the impact of a cyber attack. Malware running under privileged access can move faster, disable protections and spread more effectively across networks.

Assessors consistently identify organisations where users operate daily with elevated permissions simply because “that’s how it has always been done.”

More mature businesses take a different approach. Administrative accounts are separate, tightly controlled and only used when required. This reduces risk significantly while also demonstrating stronger operational discipline during assessment.

Firewalls and Endpoint Protection That Quietly Fail

Cyber Essentials does not simply ask whether antivirus or firewalls exist. It expects them to function properly.

Assessors frequently encounter devices where endpoint protection is broken, disabled or outdated without anyone realising it. The software may still appear to be installed, but it is no longer scanning, updating or protecting the device effectively.

The same applies to firewalls. Some organisations configure protections at the network edge but overlook local device firewalls entirely, particularly in hybrid and remote-working environments.

This creates a false sense of security. Businesses believe controls are operating because they were deployed years ago, yet nobody has validated them recently.

Effective organisations adopt a mindset of continuous verification. Security controls are monitored actively, rather than assumed to be working indefinitely after installation.

Unmanaged Applications

One of the most overlooked Cyber Essentials failure points is unused or unmanaged applications still installed across the business.

Organisations often focus on active systems while forgetting about software employees no longer use. Old remote access tools, outdated utilities, unused browser extensions and legacy applications can all create vulnerabilities if they remain installed and unsupported.

These applications are particularly risky because they are rarely monitored or updated. Over time, they become easy targets for attackers, especially if the software is no longer receiving security patches from the vendor.

Cyber Essentials assessors regularly find businesses with software that nobody actively uses but that still has access to company systems and data. In many cases, organisations are unaware the applications are even still present.

Businesses that perform well in Cyber Essentials assessments tend to keep tighter control of their software estate. They regularly review installed applications, remove unnecessary tools and ensure only approved and supported software remains in use.

The “Tick Box” Mentality

Perhaps the most important failure point is not technical at all.

Many organisations approach Cyber Essentials as a compliance exercise rather than a security exercise. The objective becomes passing the assessment instead of improving resilience. This mindset often leads to rushed submissions, incomplete answers, weak documentation and environments that technically appear compliant while underlying risks remain unresolved.

The organisations that treat Cyber Essentials seriously usually find the process easier. They already understand their environment, maintain clear operational controls and see the certification as validation of good practice rather than an obstacle to overcome.

Cyber Essentials is ultimately designed to reduce exposure to common cyber threats. The organisations that gain the most value are those that use the framework as a foundation for a stronger security culture, not simply as a certificate on a website.

Final Thoughts

Most Cyber Essentials failures are avoidable. They stem from overlooked details, inconsistent processes or assumptions that security controls are working when nobody has checked recently.

The organisations that succeed are rarely the ones with the largest security budgets. More often, they are the ones with clarity, consistency and operational discipline.

Cyber Essentials rewards businesses that understand their technology estate, maintain basic controls properly and treat cyber security as an ongoing responsibility rather than a once-a-year exercise. In a threat landscape increasingly shaped by opportunistic attacks, those fundamentals matter more than ever.

How AJC Can Help

At AJC, we help organisations make the Cyber Essentials and Cyber Essentials assessment process smooth, proportionate and meaningful. Our consultants support clients in understanding the requirements, identifying potential gaps and putting practical controls in place before assessment.

We can help businesses simplify the path to certification, align Cyber Essentials and Cyber Essentials Plus with real-world operational priorities, and turn what could feel like a tick-box exercise into genuine security value.

Contact us on 020 7101 4861 or email us at info@ajollyconsulting.co.uk if you think we can help.