This trade has a lot of acronyms and most websites list them without explanation, which rather defeats the object. So: CREST is the independent body that accredits penetration testers in the UK, and Dinah holds the CREST Registered Penetration Tester qualification, which means her testing has been examined by assessors rather than asserted on a website. IASME is the body that runs Cyber Essentials on behalf of the National Cyber Security Centre; Callum is a certified assessor for it, which is why our certifications are assessed here rather than passed to a third party who has never met you. GIAC Certified Incident Handler, which Imran holds, is the qualification that matters when the worst has already happened — it is examined on process under pressure rather than on tool knowledge. CompTIA CySA+ and the Microsoft 365 security administrator certification are Rowan’s, and they are the practical monitoring qualifications. What none of these tells you is whether somebody will ring you back. That part you will have to judge from the scoping call, which is one reason we insist on doing them.

Ninety businesses under some form of agreement as of this month, of which fifty-one are on monitoring and thirty-one hold an incident retainer. Two hundred and forty Cyber Essentials certifications issued since 2013, of which nineteen were Plus. Eleven live incidents handled since 2021, four of which turned out to be nothing. A median out-of-hours response of nineteen minutes against a one-hour commitment, measured from the call connecting to an engineer being on the problem, over the last twenty-four months. Client phishing click rates down from 31% to 9% in the first year of running simulations with a booked conversation afterwards. Our oldest client signed in 2013 and has never been through a competitive tender since; our shortest engagement lasted five weeks, when we told an insurance broker in Leeds that they needed a different kind of firm and helped them find one. We publish the awkward numbers alongside the good ones because a page of statistics without a single unflattering figure on it is a marketing document, not a record.