Cyber Essentials preparation
Find what the assessor would find —
before the assessment
Cyber Essentials asks whether your internet-facing systems are locked down, sensibly configured, and patched. SurfaceLoop shows you the answer from the outside — continuously, in plain English — so nothing surprises you at assessment time.
14 days free on your own domains. No card details, no sales call, nothing to install.
Where external scanning fits into Cyber Essentials
Cyber Essentials is the UK government-backed baseline certification, built around five technical control themes. It's increasingly required for public-sector contracts and asked about by clients and insurers. Three of the five themes have symptoms that are visible from the internet — which is exactly what SurfaceLoop watches. Two are internal, and we'll tell you plainly that we don't cover them.
To be clear: SurfaceLoop is not a certification body and doesn't issue Cyber Essentials. It's the preparation and the ongoing evidence, not the badge.
Firewalls & internet gateways
✓ covered externallyOpen-port scanning shows every service actually reachable from the internet — evidence that your boundary configuration does what you think it does, and a flag when something new opens up.
Secure configuration
✓ covered externallyFinds exposed admin panels and login pages, weak TLS configuration, and missing security headers across every discovered asset — the external symptoms of insecure configuration.
Security update management
✓ covered externallyDetects known vulnerabilities (CVEs) and outdated software on your internet-facing services — the external evidence of whether patching is actually happening.
User access control
✗ internal controlAn internal matter — SurfaceLoop scans from the outside and doesn't see your user accounts or permissions. You'll evidence this control separately.
Malware protection
✗ internal controlAlso internal — endpoint protection isn't visible externally. You'll evidence this control separately.
When businesses use it
Before the first certificate, before renewal, and in between
First-time certification
Run a scan before you self-assess. Fix the exposed panels, open ports, and unpatched services first — then answer the questionnaire from evidence, not hope.
CE Plus audits
Plus involves independent technical verification of your internet-facing systems. Find the findings on your own schedule, weeks before the assessor does.
Between renewals
Certification is annual; your attack surface changes weekly. Continuous monitoring keeps the posture you certified actually true — and alerts you when it stops being.
Frequently asked questions
- Does SurfaceLoop certify us for Cyber Essentials? +
- No. Cyber Essentials certification is issued through the official scheme and its licensed certification bodies — SurfaceLoop is not one. What SurfaceLoop does is find the externally visible problems (open ports, exposed panels, unpatched services, weak TLS) before you self-assess or face an audit, and keep watching after you certify.
- Which Cyber Essentials controls does external scanning relate to? +
- Three of the five control themes have externally visible symptoms: firewalls and gateways (what's reachable from the internet), secure configuration (exposed panels, TLS, headers), and security update management (known vulnerabilities on public services). User access control and malware protection are internal and need separate evidence.
- We're preparing for Cyber Essentials Plus — does this help? +
- Cyber Essentials Plus includes independent technical verification, which typically involves scanning your internet-facing systems. Running SurfaceLoop first means you find and fix the findings an assessor would flag — on your schedule rather than during the audit.
- We're already certified. Why keep scanning? +
- Certification is a point-in-time snapshot with an annual renewal. Your attack surface changes all year — new subdomains, expiring certificates, services someone spins up. Continuous monitoring keeps the posture you certified actually true between renewals, and gives you a head start on the next one.
- How do we start? +
- Start a 14-day free trial on your own domains — no card details and no sales call. Many businesses run the trial in the weeks before an assessment and fix what it surfaces first. A guided demo is available if you'd like a walkthrough.