UK Cyber Security Consultancy & Cyber Essentials Certification Body

43% of UK businesses identified a breach or attack last year.

Stop hoping. Start proving.

Malwise is a Salisbury-based UK Cyber Security consultancy and licensed IASME Certification Body. We certify Cyber Essentials and Cyber Essentials Plus, test what defends you, and harden the environments your business actually runs on. Whether a customer is asking, a renewal is due, or you simply want to know where you stand.

Check your Cyber Essentials readiness

Source: Cyber Security Breaches Survey 2025/26, DSIT and Home Office

Licences and professional certifications

Let's discuss your needs

30 minutes with a Senior Consultant. No commitment. No sales pitch.

Three clear starting points

The right assurance. Not more than you need.

Start with the wording in your contract, renewal notice or testing brief. These services answer different questions.

01 / Certify

Cyber Essentials

An independently verified self-assessment of essential technical controls. First certification or annual renewal.

From £320 + VAT
By organisation size · assessment only

View assessment prices

02 / Verify

Cyber Essentials Plus

Technical verification of a sample of the certification controls. Understand scope, preparation and the total cost.

From £1,415 + VAT
Cyber Essentials and Plus together

Plan your Plus audit

03 / Test

Penetration testing

Manual, scoped testing of an application or environment. Practical findings for your business and IT provider.

From £1,600 + VAT
Two tester-day minimum · scope agreed

Scope your test

Based in Salisbury. Working across Wiltshire, Dorset, Hampshire, Bristol, Portsmouth and the wider UK.

An IT provider with a client who needs certifying? How we work with IT providers →

The reality

Most breaches don't look like breaches.

The patterns we see again and again, across UK businesses of every size.

Attackers don't hack in. They log in.

Stolen credentials, partial multi-factor authentication, misconfigured Conditional Access. Most UK SMEs are exposed not because they lack tools, but because the tools they have aren't properly tightened.

Cyber Essentials is the price of entry.

Required for certain government and defence supply chain contracts, and increasingly requested by commercial customers and insurers. Most failures aren't from lack of effort, but from misreading the questions.

Work with your existing IT provider.

Independent assessment and testing can strengthen the support you already have. Agree who provides evidence, who makes changes and how findings are handed back.

The gap

Everyone says security matters. The numbers say otherwise.

43%identified a breach or attack in the past year

19%were victims of cyber crime, around 267,000 businesses

25%have a formal incident response plan

What we do

Further expertise, when you need it.

From frontline testing to strategic advice. Focused capabilities that meet real obligations.

01 / Offensive

Penetration Testing

Simulated attacks across web apps, cloud infrastructure, and internal networks. Delivered by Cyber Scheme Certified Testers.

02 / Offensive

Vulnerability Management

Continuous or one-off scanning across your websites and infrastructure. Know what's exposed, week after week.

03 / Compliance

Cyber Essentials Certification

As a licensed Certification Body, we deliver Cyber Essentials and Cyber Essentials Plus directly. Assessment, audit and certification under one roof.

04 / Assurance

Independent Security Audit

Trust, but verify. A vendor-neutral audit of your security posture, whether managed in-house or by a third-party provider.

05 / Cloud

Microsoft 365 Security

Tenant configuration review, Conditional Access hardening, multi-factor authentication enforcement, Entra ID audit. The cloud most UK businesses live in, properly secured.

06 / Strategy

Security Consulting

Risk assessments, security architecture, incident response planning, M&A due diligence. Senior advice without the senior consultancy fees.

07 / Compliance

ISO 27001 Consultancy

Implementation support to get you certified, or independent internal audit to keep you there. Gap analysis first, always.

08 / Leadership

Fractional CISO & Information Security Manager

Senior security leadership and hands-on programme management, a few days a month, without the full-time salary.

09 / Governance

IASME Cyber Assurance

Governance, risk and data protection assessed across fourteen themes. Level One is a verified assessment, Level Two adds an independent audit. Certified by us directly.

Two ways to run security

Hope is not a control.

The usual way

Unclear responsibilities between the business and IT provider
Certificates bought for decoration, then forgotten
Security questionnaires answered in a panic, badly
Nobody owns the risk, so everybody carries it
Find out what an attacker can do from the attacker

The Malwise way

Verify independently: configuration is a fact, promises are not
Certification as evidence of work actually done
Clarify the actual customer requirement before choosing a service
A named owner for security, at a size you can justify
Founder-led advice, agreed scope and separately priced support

How we work

A clear process. No surprises.

Every engagement follows the same arc: understand, test, report, fix, verify.

Discovery

Free 30-minute call. We understand your business, your risks, your obligations.

Scoping

Fixed-price proposal. Methodology, timeline, deliverables. No hidden extras.

iii

Engagement

Named delivery responsibilities, appropriate methods and clear communication throughout.

Reporting

Executive summary. Technical detail. A remediation plan your team can actually act on.

Debrief

Reporting, debrief and any included retest are defined in your proposal.

Insights

Field notes from the frontline.

08 Sep 2026 · Guides