how-to
How to Run a Cyber Essentials Plus Vulnerability Scan
Quick Summary
A Cyber Essentials Plus vulnerability scan checks whether your devices have the security fixes they need, looking for missing patches and weak settings that criminals could exploit. The tester logs in to see what is really installed and patched, rather than guessing from the outside. It covers only the defined scope, so a clean result does not mean your whole IT setup is secure.
- The scan covers operating system and software patch levels, known vulnerabilities, device configuration and exposed firewalls.
- It is an authenticated scan, meaning the tester logs in to see installed software and patch status.
- A clean scan only tests what it can see, so devices left out of scope can hide real risks.
- Cyber Essentials Plus adds independent testing to the self-assessment, and the scan turns paperwork into evidence.
- Before the assessment, list every connected device and confirm each is still supported by its manufacturer.
Table of Contents
- What a Cyber Essentials Plus Vulnerability Scan Actually Checks
- Cyber Essentials vs Cyber Essentials Plus: Where the Scan Fits
- The Cyber Essentials Plus Test Specification Explained
- Preparing Your Business: A Cyber Essentials Plus Preparation Checklist
- Step by Step: The Cyber Essentials Plus Assessment Process
- Common Vulnerabilities Found and How Fixes Are Handled
- Booking Your Vulnerability Scan and Next Steps With Hamilton Group
- Frequently Asked Questions
What a Cyber Essentials Plus Vulnerability Scan Actually Checks
A Cyber Essentials Plus vulnerability scan checks whether your devices have the security fixes they need. It looks for missing patches and weak settings that criminals could use to get into your network.
The scan is not a general health check of your whole IT setup. It sits inside a defined scope, usually your office network, the devices connected to it, and the systems you use to access business data. The National Cyber Security Centre's test specification describes this as an authenticated scan of devices, which means the tester logs in to see what is really installed and patched, rather than guessing from the outside. NCSC Cyber Essentials Plus Test Specification v3.2
The scan typically covers:
- Operating system and software patch levels
- Known vulnerabilities in installed applications
- Device configuration against the Cyber Essentials controls
- Firewalls and network services exposed to the internet
Watch out: A common mistake is assuming a clean scan means you are secure. A scan only tests what it can see. Devices left out of scope, or machines that go offline before testing, can hide real risks. Our article on why skipping vulnerability assessments is risky explains what these hidden gaps can lead to.
Cyber Essentials vs Cyber Essentials Plus: Where the Scan Fits
Standard Cyber Essentials is a self-assessment (Cyber Essentials). You answer a questionnaire about your security controls and a certification body checks your answers. Cyber Essentials Plus goes one step further. An independent assessor tests your systems directly, and the vulnerability scan is one of those tests.
This matters because the scan turns your paperwork into evidence. Anyone can say their devices are patched. The scan shows whether they actually are.
Claranet 2026 changes to Cyber Essentials and Cyber Essentials Plus
The Cyber Essentials Plus Test Specification Explained
Reading the specification yourself is useful, but it is dense. Most business owners get more out of knowing the three questions the assessor will ask:
- Which devices are in scope?
- Is each one fully patched and supported?
- Can you show the evidence?
Key terms to know:
- Authenticated scan: A scan run with login credentials, so it sees installed software and patch status.
- Scope: The set of devices and services the certification covers.
- Remediation: Fixing a finding, usually by patching or changing a setting.
Preparing Your Business: A Cyber Essentials Plus Preparation Checklist
- List every device that connects to your business network, including personal devices used for work
- Confirm each device is still supported by its manufacturer
- Turn on automatic updates for operating systems and key applications
- Remove software you no longer use
- Check that default passwords have been changed on routers and network equipment
- Confirm you have an up-to-date record of who has admin access
- Run your own check first, so you find problems before the assessor does
Step by Step: The Cyber Essentials Plus Assessment Process
Step 1: Confirm your scope. Agree with your assessor exactly which devices and systems are included.
Step 2: Remote review. The assessor checks your Cyber Essentials self-assessment answers against your actual setup. Our five-step breakdown of the remote assessment walks through each stage in detail.
Step 3: Vulnerability scan. The assessor runs an authenticated scan across in-scope devices. This shows missing patches and known weaknesses.
Step 4: On-site or remote testing. The assessor tests key controls, such as firewall rules and how user accounts are set up.
Step 5: Report and remediation. You receive findings. Fix any issues within the deadline and resubmit. Once everything passes, you receive certification.
Common Vulnerabilities Found and How Fixes Are Handled
| Finding | Typical fix | Effort |
|---|---|---|
| Missing operating system updates | Install the latest patches | Low |
| Outdated browser or plug-in | Update or remove | Low |
| Unsupported software still installed | Replace or uninstall | Medium |
| Weak or default router passwords | Change credentials | Low |
| Unsupported operating system | Upgrade or replace the device | High |
Booking Your Vulnerability Scan and Next Steps With Hamilton Group
Hamilton Group is a Cyber Essentials Plus certified partner, and we start every managed client with a Proactive IT Security Baseline. Read about the benefits and process of Cyber Essentials Certification to see how this service works.
Start with your device list today. Once you know what you have, the scan and the fixes become a manageable project rather than a source of worry.
Last Updated: 26 October 2026
Frequently Asked Questions
What is a vulnerability scan for Cyber Essentials Plus?
A vulnerability scan for Cyber Essentials Plus is an automated check of your devices and software to find known security weaknesses, such as missing patches or outdated software. The NCSC's Cyber Essentials Plus Test Specification describes an authenticated scan, meaning the scanner logs in to devices so it can see what is installed and whether fixes have been applied. The result shows which issues need fixing before the assessor signs off your certification. Because the scan only covers the defined test scope, it is important to agree that scope clearly before testing begins.
Does Cyber Essentials Plus include penetration testing?
Cyber Essentials Plus includes hands-on technical testing, but its core checks are based on the NCSC test specification rather than a full penetration test. The authenticated vulnerability scan and checks on configuration and patching are the main components. Some organisations choose to add a separate penetration test for extra assurance, but this is not a requirement of the scheme. If you are unsure what your assessor will examine, ask them to explain the test scope in writing before the visit.
How long does Cyber Essentials Plus testing take?
Pricing and timescales vary, so for a figure that reflects your own environment, please contact Hamilton Group directly for a quote.
