Cyber Essentials Discount: What the 75% Covers and Misses
On 3 November the UK government opened a fund that gives eligible small businesses a 75% Cyber Essentials discount. It is first come, first served and it will not last. If a customer has ever asked whether you hold Cyber Essentials, read on.
What actually happened
The Department for Digital, Culture, Media and Sport announced the Cyber Essentials First Step Fund on 3 November 2026. GOV.UK says the £2.4m fund gives a 75% discount to micro, small and medium-sized UK businesses that have not been certified in the last four years. Eligible firms could pay as little as £80 and no more than £125, plus VAT. It runs until March 2027, or until the money runs out. The government estimates about 6,000 businesses could benefit. Applications start at firststep.iasme.co.uk.
One wrinkle. A separate GOV.UK funding page describes the fund as for SMEs applying for their first certificate. The press release uses the four-year wording. Check your own eligibility on the application page before you plan around it.
The same announcement covers a separate grant for selected suppliers of Cyber Resilience Pledge signatories. You cannot apply for that one directly. Your customer nominates you.
Why the Cyber Essentials discount matters to a small or mid-sized business
The discount is real money, and the certificate often unlocks contracts. But be clear about what you are buying.
GOV.UK describes Cyber Essentials as the minimum standard the government recommends. It is aligned to five technical controls designed to prevent the most common internet-based threats. Those controls are firewalls, secure configuration, security update management, malware protection and user access control. Done properly, they close the doors that opportunistic attackers try first: unpatched software, default passwords, exposed services, accounts with too much access.
What it does not do is test your business the way an attacker would. A certificate tells a customer you have the basics in place on the day of assessment. It does not tell them whether your customer portal lets one user read another user’s records. It does not show whether a stolen session cookie gets someone into your admin panel. It does not check whether a chain of small weaknesses adds up to a way in. Those are application and logic problems, and they are what a manual penetration test looks for.
The two answer different questions. Cyber Essentials asks “are the basics done?” A pentest asks “can someone get in anyway?”
Treat the discount as a cheap, sensible first step. Do not treat the badge as the finish line.
What to do this week
- Ask your IT person whether you held Cyber Essentials at any point in the last four years, then check the eligibility rules on the application page.
- If you want the discount, apply early, because funding is first come, first served and will run out.
- Before you apply, have your IT person list every device, laptop, phone and cloud account in scope, and check each is on supported, patched software.
- Remove unused admin accounts and turn on multi-factor authentication for email, finance and admin logins.
- Ask yourself what is outside the scope of the certificate, such as your website, customer portal or any custom software, and decide who will test it.
How Wolfcore helps
Wolfcore is Cyber Essentials certified, so I know what the assessment asks of a small team. We are not CREST or CHECK accredited, and we do not claim otherwise. We simulate attackers through manual penetration testing, which is the part the certificate does not cover. If you want to see how your public website looks to an attacker first, run the free web vulnerability scan. If you would rather talk it through, see our penetration testing and secure-by-design compliance services, or book a conversation. We can also give general help with where Cyber Essentials fits in your wider security plan.
For a plain-English explainer, see our Resources entry on Cyber Essentials.
Frequently asked questions
How much does Cyber Essentials cost with the discount?
Eligible firms could pay as little as £80 and no more than £125, plus VAT, according to GOV.UK.
Who can apply for the 75% discount?
The press release says micro, small and medium-sized UK businesses not certified in the last four years. A separate funding page says first certificate, so check the application page.
Does Cyber Essentials replace a penetration test?
No. It checks that the basic controls are in place. A manual penetration test looks for application and logic weaknesses the certificate does not test.
Ruben Selby
Founder and Lead Security Consultant, Wolfcore