Cyber Essentials May 2026 Update: What Businesses Need to Do to Pass v3.3
What the Cyber Essentials Requirements for IT Infrastructure v3.3 Changes Mean for Your Business
Cyber Essentials continues to evolve to reflect the realities of modern Cyber Security. From 27 April 2026, all new Cyber Essentials assessments are being assessed against Requirements for IT Infrastructure v3.3, introducing more rigorous expectations around cloud security, authentication and resilience.
This update is more than a routine refresh. It reflects how organisations now operate, with cloud‑first services, remote working and increasingly sophisticated threats firmly in scope. For businesses planning certification or renewal after May 2026, understanding these changes early is essential.
This guide breaks down what has changed and, more importantly, what practical steps organisations should take to remain compliant and resilient.
We’ve awarded over 1,500 Cyber Essentials and Cyber Essentials Plus accreditations
Why Is Multi‑Factor Authentication Now Mandatory Under Cyber Essentials v3.3?
One of the most significant changes in v3.3 is the mandatory enforcement of Multi‑Factor Authentication.
Where MFA is supported, whether it is free, bundled or paid for, it must be enabled for all users. Failure to do so will now result in an automatic fail.
What this means in practice
Organisations must:
- Audit all user accounts across email, cloud platforms and administrative portals
- Enable MFA consistently, including for privileged and administrative users
- Remove legacy authentication methods that bypass MFA
This change improves accountability and dramatically reduces the risk of credential‑based attacks, which remain one of the most common causes of breaches.
How Are Cloud Services Treated Under the Updated Cyber Essentials Requirements?
Under v3.3, any cloud service that stores or processes organisational data is now in scope. This removes previous ambiguity around excluding Software‑as‑a‑Service platforms.
Practical considerations for business
You should now:
- Maintain a complete inventory of cloud services in use
- Apply Cyber Essentials controls consistently across Microsoft 365, Google Workspace, CRM platforms and file‑sharing tools
- Ensure access controls, MFA and patching responsibilities are clearly defined with suppliers
This change reflects how critical cloud services have become to day‑to‑day operations and ensures security controls keep pace.
What Do the New Cyber Essentials Scoping Rules Mean for Devices and Services?
The previous concepts of “untrusted” or “user‑initiated” devices have been removed.
The new rule is straightforward: If a device or service connects to the internet, or manages internet‑connected data, it is in scope.
Why this matters
This clarity reduces misinterpretation during assessments and ensures organisations take a more holistic view of their environment. Laptops, mobile devices, servers and cloud platforms should all be considered equally when applying controls.
How Have Application Development Requirements Changed in Cyber Essentials v3.3?
The scope formerly referred to as “Web Applications” has now evolved into Application Development.
This aligns Cyber Essentials with the UK Government’s Software Security Code of Practice, increasing focus on:
- Secure coding principles
- Timely patching of applications and frameworks
- Managing vulnerabilities throughout the development lifecycle
Guidance for development teams
Organisations involved in application development should:
- Document secure development practices
- Keep third‑party libraries up to date
- Demonstrate how vulnerabilities are identified and remediated
This change reinforces that security must be built in, not bolted on.
Why Is Passwordless Authentication Being Encouraged by Cyber Essentials?
While not yet mandatory, v3.3 actively promotes passwordless authentication such as passkeys and FIDO2 authenticators.
Why organisations should take notice
Passwordless authentication:
- Reduces reliance on weak or reused passwords
- Improves user experience without sacrificing security
- Aligns with the long‑term direction of secure identity management
Adopting passwordless methods now can simplify future compliance and strengthen overall security posture.
What Are the New Backup and Recovery Expectations Under Cyber Essentials v3.3?
Backup and recovery have received increased emphasis under the updated requirements.
Organisations must demonstrate that backups are:
- Robust and documented
- Protected from unauthorised access
- Regularly tested to ensure recovery is achievable
Practical steps to take
Businesses should review:
- Backup frequency and retention policies
- Offline or immutable backup options
- Evidence of routine restore testing
This ensures organisations are better prepared to recover from ransomware or other disruptive incidents.
When Do the Cyber Essentials v3.3 Changes Take Effect and What is the Deadline?
There is a critical timing consideration for organisations planning certification.
- Assessments set up before 27 April 2026 will follow the previous standard
- Assessments initiated on or after this date must comply with v3.3
For some organisations, this presents a short‑term opportunity. For most, however, preparing for the new requirements is the more sustainable approach.
How Can Organisations Prepare for Cyber Essentials Certification After May 2026?
The v3.3 update raises the bar, but it also brings clarity. Organisations that take a proactive approach will find that these changes not only support compliance but meaningfully improve resilience.
Key preparation steps include:
- Reviewing MFA coverage across all systems
- Bringing all cloud services into scope
- Updating asset inventories and scoping assumptions
- Strengthening backup and recovery processes
- Aligning development practices with secure coding standards
How Can CyberLab Support Your Cyber Essentials Journey Post‑May 2026?
Navigating updated Cyber Essentials requirements can be complex, particularly for organisations with growing cloud environments.
CyberLab supports businesses through:
- Cyber Essentials readiness assessments
- Practical remediation guidance
- Ongoing Cyber Security strategy aligned to evolving standards
If you are planning Cyber Essentials certification or renewal after May 2026, now is the right time to act.
Get Cyber Essentials Certified
Show your commitment to cyber security and reduce risk by gaining Cyber Essentials certification – the UK government-backed standard for defending against common threats.
As an IASME-approved assessor for Cyber Essentials and Cyber Essentials Plus, we make the process simple with tailored options to suit your technical capability and business needs.
Join over 120,000 organisations already certified and take the first step towards stronger security today.
CyberLab Shortlisted for 'Best Cybersecurity Solution': Comms Business
Comms Business Awards 2025
We’re proud to announce that CyberLab has been shortlisted for Best Cybersecurity Solution at the 2025 Comms Business Awards!
The Comms Business Awards celebrate excellence, innovation, and customer impact across the UK channel.
“Being nominated at the Comms Business Awards is a fantastic recognition of the innovation and dedication that drive CyberLab.
To be shortlisted in such a competitive category is a fantastic recognition of the impact that we have had in helping businesses to thrive in an increasingly hostile digital landscape, and we’re honoured that it is considered among the best in the industry.”
– Gavin Wood, CEO, CyberLab
We demonstrated how our work with Sealey Group progressed from a penetration test to Sophos MDR, Mimecast email security, and firewall management from CyberLab Managed Services, and how it hardened Sealey Group’s defences, reduced the risk of downtime and ensured the uninterrupted flow of operations.
The winners of the Comms Business Awards will be revealed at the ceremony in July, and we look forward to celebrating with peers and partners from across the industry.
In the meantime, if you’re looking for a cyber security partner to expand your offering and improve your customers’ security, speak with an expert from our Channel team today.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Defence in Depth: Layered Security Strategy for Modern Cyber Risks
Securing Organisations Against the 2025 Threat Landscape
Cyber security threats in 2025 have become more advanced, with attackers leveraging AI, supply chain vulnerabilities, and geo-political tensions to launch increasingly sophisticated and targeted campaigns.
As cyber threats grow in complexity and capability, Defence in Depth remains one of the most effective strategies to protect organisations against threats and mitigate the advancement of cyber attacks.
What is Defence in Depth?
Defence in Depth is a layered security approach that ensures multiple safeguards are in place to protect against various attack vectors.
Rather than relying on a single security measure, this strategy integrates multiple defensive layers. These defensive layers range from physical and network security to user training and incident response. The benefit of this layered approach to defence is that if one layer is breached, others continue to provide protection.
The 2025 Cyber Threat Landscape
According to the NCSC Cyber Security Breaches Survey 2024, 50% of businesses reported experiencing a cyber-attack or breach in the past year. While larger enterprises remain primary targets, 32% of medium-sized businesses and 27% of small businesses also faced cyber incidents, highlighting the growing need for strong cyber security strategies. [source: NCSC]
Increased Attacks on Critical National Infrastructure & Supply Chains
Nation-state actors and cyber-criminal groups are increasingly targeting essential services such as energy, water, healthcare, and transportation. Supply chain attacks have also surged, with attackers infiltrating widely used software and IT providers to gain access to multiple organisations at once.
Defence in Depth Mitigation:
- Network segmentation to isolate critical assets.
- Continuous monitoring and risk assessment of third-party vendors.
- Zero Trust architecture to limit access to essential systems.
- Incident response planning for handling supply chain disruptions.
Rise in Ransomware & Data Extortion Attacks
Ransomware remains a top threat, with attackers adopting double and triple extortion tactics. The 2024 survey found that 19% of businesses that suffered a breach were targeted by ransomware, often leading to financial and reputational damage.
Defence in Depth Mitigation:
- Regular vulnerability scanning and patch management.
- Penetration testing across the IT estate
- Immutable backups to protect against data loss.
- Network segmentation to limit ransomware spread.
AI-Driven Social Engineering & Business Email Compromise (BEC)
Cybercriminals have now started using AI-powered phishing campaigns, deepfake technology, and social engineering tactics to manipulate employees and executives into revealing sensitive information or transferring funds.
According to the UK Department for Science, Innovation & Technology phishing remains the most common type of cyber incident in 2025, with 74% of businesses and 72% of charities reporting they experienced a phishing incident in the past 12 months.
Defence in Depth Mitigation:
- Email filtering and anomaly detection. Consider AI-powered tools that can intuitively detect and remove even the most advanced phishing emails.
- Multi-factor/2-factor authentication (MFA/2FA) remains the single most effective control against phishing attempts.
- Security awareness training focused on AI-driven threats.
- Verification processes for high-value transactions.
Implementing Defence in Depth: A Multi-Layered Approach
Defence in Depth was originally adapted from an ancient military strategy, designed to slow the advancement of an attacking enemy so that they exhaust their resources and lose momentum.
Translated into the field of cyber security, this strategy can buy targeted organisations vital time to adapt and respond to the incident, ensuring the most sensitive assets remain protected.
To be prepared to face a real cyber incident, organisations must implement a Defence in Depth strategy that covers all aspects of cyber security, including:
1. Physical Security – Secure data centres, restrict access, and implement biometric authentication. Physical penetration testing such as Red Team/Tiger Team exercises should be conducted on physical security measures, assessing access control weaknesses, surveillance blind spots, and the effectiveness of security response procedures. Red Team exercises can simulate real-world intrusions, testing how well physical security controls prevent unauthorised access.
2. Network Security – Deploy firewalls, IDS/IPS, and enforce network segmentation. Regular penetration testing should be conducted against network perimeter defences, external and internal infrastructure, internal network segmentation, and VPN security.
3. Endpoint Security – Use robust endpoint detection & response (EDR) solutions or consider partnering with a managed security services provider (MSSP) for managed detection & response (MDR) services. Testing should evaluate endpoint resilience, including BYOD policies and remote device security.
4. Application Security – Conduct regular security testing and vulnerability assessments of public-facing and internal applications, including any exposed API endpoints.
5. Data Protection – Enforce encryption, access controls, and backup strategies.
6. User Training & Awareness – Conduct ongoing cyber security education to recognise phishing and social engineering threats.
7. Incident Response & Business Continuity – Develop incident response plans, and test them utilising services such as penetration testing and red teaming.
8. Zero Trust Architecture – Use zero-trust architecture and implement strict verification protocols across all access points.
9. Vulnerability Management – Continuously monitor, assess, and remediate security gaps across infrastructure, cloud environments, and operational technology (OT) by using vulnerability management tools, and patching software.
10. Red Teaming & Attack Simulations – Organisations should consider conducting red team assessments, not just against their physical security controls, but to test the overall effectiveness of their Defence in Depth strategy, evaluating how well layers of security work together to detect and respond to advanced persistent threats (APTs) across various sophisticated attack scenarios.
Conclusion: Why Defence in Depth is More Critical Than Ever
As cyber threats become more advanced and widespread, adopting a Defence in Depth approach is no longer optional – it is essential. By implementing multiple layers of security across networks, endpoints, cloud environments, applications, and user domains, organisations can significantly reduce their risk exposure.
Whether securing a nation’s critical infrastructure, a large enterprise, or an SME, a well-planned Defence in Depth strategy ensures resilience against ever-evolving threats.
With AI-powered cyber-attacks, state-sponsored threats, and ransomware innovations reshaping the threat landscape organisations should review their current cyber security strategy today and take pro-active steps to implement a robust Defence in Depth approach.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Quick Wins to be Cyber Secure: Five Fast Fixes Every Business Should Use
Five Fast Fixes to Strengthen Your Business Against Cyber Threats
Cyber security can feel overwhelming, especially for small and medium-sized enterprises (SMEs) with limited resources.
But there are simple, high-impact actions that can dramatically improve your organisation’s security posture. , Security Testing Pre-Sales Consultant at CyberLab, outlines five practical steps every business should take.
Mobile Device Management
Smartphones and tablets often access sensitive business data but operate outside the safety of office networks.
SMEs should:
- Identify what data mobile devices can access (e.g. email, Teams, OneDrive).
- Use mobile device management (MDM) tools like Microsoft Intune or Sophos Mobile to control access and enforce security policies.
- Ensure devices are encrypted, password-protected, and remotely wipeable.
Email Security
Phishing remains the most common attack vector for UK SMEs.
To reduce risk:
- Apply the principle of least privilege – limit account access to only what’s necessary.
- Train staff to spot phishing signs: suspicious links, urgent language, poor grammar, and unexpected attachments.
- Implement a clear reporting process for suspected phishing emails.
- Use tools like Microsoft 365’s Phishing Investigation feature to automate detection and response.
Keep Systems Up to Date
Unpatched software is a major vulnerability.
SMEs should:
- Maintain an inventory of devices and software.
- Enable automatic updates and apply patches within 14 days of release.
- Monitor for end-of-support products and replace them promptly.
- Use vulnerability scanning tools to identify gaps missed by manual checks.
Passwords and Authentication
Weak passwords are a top concern for SMEs in 2025.
Strengthen access controls by:
- Enforcing multi-factor authentication (MFA) for all users, especially admins.
- Providing password managers to help staff create and store strong credentials.
- Avoiding frequent forced password changes – only reset when compromise is suspected.
- Monitoring for compromised credentials on the dark web using services like HackRisk.
Cyber Awareness
Technology alone isn’t enough – your people must be trained to use it securely.
Build a strong security culture by:
- Offering regular awareness training and phishing simulations.
- Encouraging prompt reporting of incidents without fear of punishment.
- Making security part of everyday conversations, not just IT’s responsibility.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
What is Secure Access Service Edge (SASE) and How Does it Work?
What You Need To Know
Secure Access Service Edge (SASE) is a modern approach that combines wide area networking with cloud‑delivered security to provide secure, reliable access to applications and data from any location.
As organisations adopt hybrid work and cloud services, SASE helps maintain consistent security and user experience without relying on traditional, data centre‑centric designs.
CyberLab explains what SASE is, the core components, how it differs from Security Service Edge (SSE), and when to prioritise each.
What is Secure Access Service Edge (SASE)?
SASE (pronounced “sassi” or “sassy”) converges SD‑WAN capabilities with cloud‑based security controls. Instead of routing all traffic through a central data centre, SASE enforces security as close as possible to the user, device or branch, and then connects to applications wherever they live, whether in public cloud, private data centres or SaaS.
At its core, SASE:
- Uses identity as the primary control point. Policies follow the user, device and context, not an IP address or fixed location.
- Delivers networking and security as a service, so controls are consistent and scalable.
- Improves user experience by steering traffic intelligently and enforcing security without unnecessary backhaul.
SASE Components
SASE brings together several building blocks. Individual features may already exist in many environments; SASE unifies them with a single policy and delivery model.
1) Software‑defined Wide Area Network (SD‑WAN)
SD‑WAN uses software to route traffic over multiple links such as MPLS, broadband and LTE. It prioritises important applications, improves resilience and reduces reliance on costly private circuits. Policies decide the best path based on performance, availability and business need.
2) Cloud Access Security Broker (CASB)
A CASB sits between users and cloud services to apply enterprise security policies. Typical functions include authentication, authorisation, data loss prevention, encryption or tokenisation, device posture checks, logging and threat detection for SaaS usage.
3) Firewall as a Service (FWaaS)
FWaaS delivers next‑generation firewall capabilities from the cloud. Instead of running and scaling on‑premises appliances, traffic is inspected in the provider’s fabric using a consistent rule set for all locations and users.
4) Zero Trust Network Access (ZTNA)
ZTNA replaces broad network access with explicit, least‑privilege access to specific applications. Every request is authenticated and authorised based on identity, device health and context. The principle is simple: never trust, always verify.
5) Secure Web Gateway (SWG)
An SWG protects users when accessing the web. It filters malicious content, enforces acceptable use policies, applies DNS and URL controls, and inspects traffic for threats and data exfiltration.
SASE vs SSE: What is Security Service Edge?
Security Service Edge (SSE) focuses on the security stack of SASE without the SD‑WAN element. SSE typically includes ZTNA, CASB, SWG and FWaaS delivered from the cloud. It is often the fastest path to modernise security for a distributed workforce when the underlying WAN is not being replaced.
- Choose SSE when the priority is to standardise and uplift security controls for remote users, branches and cloud access, while keeping the existing WAN in place.
- Choose SASE when you also want to modernise the WAN, consolidate providers and policies, and optimise performance end to end.
How SASE Works in Practice
- User or device connects from any location.
- Traffic is steered to the nearest point of presence for policy enforcement.
- Identity, device posture and context are evaluated.
- Security controls are applied: ZTNA for private apps, SWG and CASB for web and SaaS, FWaaS for general traffic.
- SD‑WAN selects the optimal path, delivering consistent performance and security.
This model removes unnecessary backhaul, improves visibility and simplifies operations with one policy plane.
Why Organisations Adopt SASE or SSE
- Consistent security everywhere: The same policies apply to users in the office, at home or on the move.
- Identity‑centric control: Policies follow users and devices, improving auditability and incident response.
- Better user experience: Local breakout and smart routing reduce latency and improve SaaS performance.
- Operational simplicity: Fewer point products, centralised policy and unified monitoring.
- Scalability and agility: Capacity and features scale as a service, not by installing new hardware.
- Stronger zero trust posture: Minimise implicit trust and reduce lateral movement.
Getting Started: Practical Steps
- Map use cases and traffic flows
Identify who needs access to what, from where and on which devices. Prioritise high‑value applications and sensitive data. - Establish identity and device health as gates
Integrate identity providers and device management so that policy decisions consider user role and device posture. - Start with SSE for quick wins
Deploy ZTNA for private apps, SWG and CASB for web and SaaS, and FWaaS for consistent inspection. This can coexist with your current WAN. - Plan SD‑WAN evolution
When ready, add SD‑WAN to consolidate connectivity, improve performance and complete the SASE model. - Consolidate vendors and policies
Aim to reduce overlap and complexity. Fewer consoles and a single policy model make operations more effective. - Measure and iterate
Track user experience, incident rates and policy coverage. Use findings to refine posture and roadmap.
Common Pitfalls to Avoid
- Treating SASE as a product rather than an architecture and operating model.
- Lifting and shifting legacy allow‑all access instead of enforcing least privilege.
- Ignoring identity and device posture in policy decisions.
- Running overlapping tools without a plan to consolidate, which increases cost and weakens visibility.
- Neglecting change management and training, which are essential for adoption.
Talk to CyberLab
CyberLab helps organisations assess where SASE or SSE fits, design a pragmatic roadmap and implement the right controls at the right pace. If your team would like to explore options or validate your direction, we are available for a free initial consultation to discuss goals, constraints and next steps.
We help organisations work securely from anywhere, with security that is consistent, proportionate and easy to manage.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
CyberLab Partners with The Eastern Cyber Resilience Centre
New Partnership Helping Local Businesses and Organisations to Strengthen Their Cyber Defences
CyberLab announce a new partnership with The Eastern Cyber Resilience Centre (ECRC), a trusted resource for support to protect businesses and third sector organisations in the country.
The Eastern Cyber Resilience Centre (ECRC) is part of the national roll out of Cyber Resilience Centres in the UK which began in 2019.
Led by Policing and facilitated by Business Resilience International Management (BRIM), ECRC have followed a structured modular programme based on a highly successful model that had previously been established for over 9 years in Scotland. ECRC work in structured partnership with regional Policing, Academia, Businesses, Third and Public Sector organisations through a variety of ways including training, assessments, and incident response advice.
As an IASME-approved assessor for Cyber Essentials and Cyber Essentials Plus, CyberLab offers various options depending on your requirements and technical ability. The team, with their extensive experience, has helped thousands of companies and public sector organisations get certified and is rated “Excellent” by its customers on Trustpilot.
“We’re looking forward to working closer with The Eastern Cyber Resilience Centre to help protect, upskill and educate the local community.
The initiatives delivered by the ECRC are a fantastic way to safeguard businesses and organisations from the dangers of the Dark Web and cyber threats.
With cyber attacks it’s a question of when, not if, and we all play our part in building the nation’s cyber resilience.”
– Wayne Price, Commercial Director at CyberLab
About CyberLab
CyberLab is a specialist cyber security company that provides a wide range of security solutions and services.
Your one-stop cyber security advisor, the CyberLab team is equipped with the right technology, knowledge, and expertise to help businesses of all sizes, including large public sector organisations.
By leveraging world-class technology, decades of experience, and their extensive vendor partnerships, CyberLab have helped to secure thousands of organisations across the UK.
About The Eastern Cyber Resilience Centre (ECRC)
The Eastern Cyber Resilience Centre (ECRC) supports and helps protect SMEs, supply chain businesses and third sector organisations in the East of England against cyber crime.
Working with local Universities and Regional Police forces provides ECRC with access to the latest local, as well as National information, on emerging cyber threats, criminal trends, best practice for cyber resilience and new technology.
ECRC will provide you with timely guidance to prepare and protect your business, staff and clients from cyber criminals.
ECRC provide affordable testing and training services, with the opportunity to learn how to procure private sector cyber services where needed.
As a trusted resource, ECRC are a straightforward place to find IASME- approved Cyber Essentials and Cyber Essentials Plus Certifiers in the East. These are recognised nationally as Trusted Partners.
The Eastern Cyber Resilience Centre is modelled on a successful structured collaboration acclaimed by the National Police Chiefs’ Council (NPCC). It is part of a developing network of not-for-profit Resilience Centres across the UK with Business Resilience International Management.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
CyberLab joins the Cyber and Fraud Centre – Scotland: Protecting Scottish Businesses
New Membership Helping Scottish Businesses Strengthen Cyber Resilience
CyberLab is proud to join the Cyber and Fraud Centre Scotland, strengthening our commitment to helping businesses stay secure through expanded community outreach.
The Cyber and Fraud Centre – Scotland is a leading organisation dedicated to equipping businesses with the knowledge and resources needed to combat cyber threats and fraud.
The Centre plays a critical role in supporting businesses, charities, and social enterprises by providing expert-led training, practical advice, and access to essential security resources. Its unique partnerships with Police Scotland and the Scottish Government place the Centre at the forefront of national cyber security and fraud prevention efforts.
“We’re thrilled to join forces with the Cyber and Fraud Centre – Scotland to support businesses and organisations in becoming more secure and resilient. The Centre’s socially driven mission and partnerships with key national bodies align perfectly with our commitment to building a safer digital future.
As cyber threats evolve, collaboration is essential. Together, we aim to provide businesses with the tools and knowledge needed to navigate today’s complex security landscape.”
– Wayne Price, Commercial Director at CyberLab
Through this membership, CyberLab will collaborate closely with the Centre to enhance its security offerings, benefiting from expert insights and tailored training programmes. These initiatives will empower businesses of all sizes to strengthen their defences, reduce risks, and build long-term resilience against cyber and fraud-related threats.
“We’re delighted to have CyberLab join the Scottish Cyber Security Network. Their experience and dedication to improving the cyber security landsdcape in Scotland will be a real asset to our membership community.
Collaborating with members like CyberLab strengthens our shared efforts to enhance Scotland’s cyber resilience, and we’re excited about the contributions they’ll bring to the network.”
As cyber threats evolve, collaboration is essential. Together, we aim to provide businesses with the tools and knowledge needed to navigate today’s complex security landscape.”
– Jude McCorry, CEO at Cyber and Fraud Centre Scotland
About CyberLab
CyberLab is a specialist cyber security company that provides a wide range of security solutions and services.
Your one-stop cyber security advisor, the CyberLab team is equipped with the right technology, knowledge, and expertise to help businesses of all sizes, including large public sector organisations.
By leveraging world-class technology, decades of experience, and their extensive vendor partnerships, CyberLab have helped to secure thousands of organisations across the UK.
About The Cyber and Fraud Centre Scotland
The Cyber and Fraud Centre – Scotland is a leading and trusted provider of cyber services, training, and advice. Its team is dedicated to protecting organisations across Scotland. As a social enterprise, the Centre stands apart from other cyber support providers by reinvesting in the cyber community. This ensures that every business, charity, membership body, or social housing organisation it supports – regardless of size or structure – has access to essential security resources.
By combining expert knowledge with a socially driven mission, the Centre is reshaping how cyber support is delivered, fostering trust, collaboration, and a shared commitment to a safer digital future.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Chess Acquires CyberLab: Building a Cyber Security Powerhouse
Chess and CyberLab: Building a Cyber Security Powerhouse
Chess Cyber Security and CyberLab have combined forces to deliver one of the most comprehensive cyber security offerings in the UK.
This strategic integration brings together deep technical expertise, innovative technology, and a proven track record of helping organisations manage risk and strengthen resilience.
Why This Matters for Customers
Cyber threats continue to evolve, and businesses need partners who can provide end-to-end protection – from assessment and testing to consultancy, implementation and ongoing management.
By joining Chess, CyberLab enhances this capability, creating a single point of access for:
- Testing and assurance: Penetration testing, vulnerability assessments, and compliance audits
- Managed security services: Continuous monitoring, threat detection and response
- Governance and certification: Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance
- Security-as-a-Service (CSaaS): A holistic platform that combines consultancy, technology and training to simplify cyber risk management
What CyberLab Brings to the Table
CyberLab introduced an innovative security-as-a-service model, giving organisations a centralised portal to:
- View and manage their security posture
- Identify individual blind spots
- Automate fixes with tailored training programmes
- Access compliance frameworks and reporting in one place
This approach makes cyber security simpler, more transparent and more actionable for businesses of all sizes.
A Track Record of Excellence
Chess has long been recognised as a trusted technology partner, with awards including:
- Sophos Public Sector Partner of the Year (10+ years)
- Sophos Mid-Market Partner of the Year
- Forescout Commercial Partner of the Year
- Consistently ranked in the Top 100 Companies to Work For
The integration of CyberLab builds on previous milestones, such as the acquisition of Armadillo Sec and Foursys, reinforcing Chess’s position as a leader in cyber security.
What This Means for You
Today, customers benefit from:
- Comprehensive coverage: From discovery and testing to consultancy and managed services
- Expertise at scale: CREST-accredited penetration testers, certified consultants and award-winning partners
- Simplified management: A single portal for posture assessment, compliance and training
- Future-ready security: Solutions designed for hybrid work, cloud adoption and evolving threat landscapes
Looking Ahead
Cyber security is critical for every organisation.
By combining Chess’s breadth of services with CyberLab’s specialist capabilities, we provide the agility, insight and technology needed to protect businesses now and in the future.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
CyberLab Celebrates Recognition in Top 100 Best Companies 2025
CyberLab Celebrates Three Top 10 Results in Best Companies 2025
🏆 #8 Best Small Company To Work For in the UK
🏆 #10 Best Company to Work For in the North West
🏆 #5 Best Company to Work For in the Technology Sector
CyberLab is proud to celebrate our latest recognition in the prestigious Best Companies™ 2025 rankings!
These outstanding achievements are a testament to the incredible people who make CyberLab what it is. Their passion, creativity, and commitment to building a culture of excellence continue to drive us forward.
A Message from CEO Gavin Wood
“I’m incredibly proud to announce that once again we’ve delivered a fantastic result in this year’s Best Companies survey, and this time we’ve improved on last year’s performance.
What makes this achievement meaningful is the collective effort behind it. From our people helping our customers defend against the evolving cyber security threat landscape, to our leadership team shaping culture and direction, every person has played their part.
Our focus on Simplicity, Passion and Quality continues to pay off. This advance isn’t just a number or a badge. It’s a signal that our commitment to being a great place to work, and a great partner for our customers, is working.
As we grow, evolve and tackle new challenges, maintaining our culture is just as important as hitting targets. A big thank you to the whole team. Let’s build on this momentum and make next year even stronger.”
“I am over the moon to announce our results for Best Companies 2025. These incredible results are a testament to our people, plus their hard work and dedication in making CyberLab a great place to work.”
– Mimi Rostron, People & Culture Manager
At CyberLab, we believe that prioritising the wellbeing of our people is essential to both personal and organisational growth.
In this milestone year, we extend our heartfelt thanks to our incredible team. Their passion and commitment make this recognition possible, and we look forward to building on this success together.
Top 5 Cyber Security Predictions for 2026 and How to Prepare Now
Expert Insights from the CyberLab Board
In November 2025, the UK Government released a comprehensive report on the economic cost of cyber crime, which highlights how the average cyber incident costs a UK business £195,000. Scaling this to an annual UK cost, generates an estimate of £14.7 billion, equivalent to 0.5% of the UK’s GDP [Source]. The growing threat landscape and significant cost of cyber crime makes cyber security a pressing issue for all UK businesess.
2026 is set to be a landmark year for cyber security. AI, deepfake technology, quantum risk and supply chain vulnerabilities are converging to reshape the cyber landscape. Cyber criminals are now faster, more scalable and increasingly autonomous, relying less on human expertise and more on intelligent, self-learning tools.
In response, cyber defence must evolve too. It is no longer enough to react. Security needs to be predictive, adaptive and capable of operating at machine speed.
CyberLab’s Board have put together their predictions for 2026, and their insights reveal powerful themes that businesses must prepare for.
1. AI Changing the Threat Landscape: Defence and Attack at Machine Speed
AI is not just changing cyber security. It is redefining it. In 2026, AI will accelerate cyber defence, enabling faster detection, automated response and real-time threat modelling. However, it is also lowering the barrier to entry for cyber criminals, powering attack strategies that are faster, continuous and increasingly self-managing.
David Pollock, Chairman, highlights this duality:
“AI will speed up hackers’ ability to attack businesses and government. AI will also speed up our ability to defend and protect our customers.”
We will see a shift from human-led attacks to AI-led adversaries capable of executing cyber attacks without direct human involvement. These systems will operate at machine speed, identifying vulnerabilities, exploiting zero-day flaws and coordinating simultaneous attacks across multiple networks.
AI-driven attacks will be able to adapt mid-attack, changing strategies in response to defensive actions. They will learn from failed attempts, replicate successful exploits and scale attacks globally in seconds.
Ryan Bradbury, CTO, explains:
“The speed, scale and automation possible with agent-driven attacks will surpass anything we’ve seen before. We have to stop preparing only for human-led threats and start planning for autonomous AI-led adversaries.”
This means cyber defence will need to become dynamic, adaptive and automated. Continuous validation, predictive analytics and machine-speed response will become non-negotiable. AI-led defence will become the standard, not the exception.
2. Deepfakes, Identity Fraud and the Human Factor
While AI transforms the technical threats, humans will remain the most vulnerable target. In 2026, social engineering will become significantly more sophisticated as deepfake technology enables hyper-realistic voice, video and identity spoofing.
Wayne Price, Commercial Director, warns:
“Deepfakes and synthetic media will cause a surge in identity fraud, forcing organisations to ramp up digital identity verification practices.”
Attacks will no longer rely on poorly written phishing emails. Instead, employees may receive video messages from a supposed CEO requesting payment transfers, or voice calls mimicking trusted suppliers.
Gavin Wood, CEO, believes identity protection and human awareness will be critical:
“Human attack vectors will continue to be exploited, especially with AI-driven deepfakes, voice spoofing, phishing, and super realistic, authentic-looking videos, et cetera. Securing the human will be absolutely key for cyber security in 2026.”
Identity and access management will become one of the most important areas of cyber security, with organisations investing heavily in digital identity verification, behavioural biometrics and continuous trust authentication.
3. The Future of Ransomware and Smarter Phishing
Ransomware will remain one of the biggest threats in 2026, but AI will make it more intelligent, harder to detect and significantly more scalable. Attackers will use AI to craft personalised phishing emails that are context-aware and perfectly mimic internal communications or supplier messages.
Adam Myers, Sales Director, has seen a clear rise in this trend:
“We’re seeing emails that look more real and on brand. It’s harder to spot. AI is helping hit that on scale.”
These emails are technically perfect, grammatically accurate and contextually relevant, making them almost indistinguishable from legitimate communications. AI will also be used to test email variations, conducting A/B testing on targets to improve success rates.
Elena Doncheva, Marketing Director, advises:
“Train your people, as they will likely be the first line of defence. Monitor your digital footprint and the dark web for data that attackers can utilise. Test your business continuity plans, disaster recovery and incident response plans. You can never be too prepared.”
4. Quantum Risk, IoT Growth and Zero Trust Security
Technology will continue to evolve, bringing both opportunity and risk. Quantum computing, while still emerging, poses a direct challenge to current encryption standards. Organisations will need to begin preparing now by exploring quantum-resistant security measures.
Wayne Price summarises the shifting landscape:
“Expect AI, deepfakes, ransomware, quantum computing, and a surge in IoT and cloud-connected devices to reshape cyber security in 2026.”
The growth of connected devices, cloud services and remote infrastructure will dramatically widen the attack surface. This will push organisations towards adopting zero trust frameworks, continuous monitoring and automated threat detection.
While AI transforms the technical threats, humans will remain the most vulnerable target. In 2026, social engineering will become significantly more sophisticated as deepfake technology enables hyper-realistic voice, video and identity spoofing.
Wayne Price, Commercial Director, warns:
“Deepfakes and synthetic media will cause a surge in identity fraud, forcing organisations to ramp up digital identity verification practices.”
Attacks will no longer rely on poorly written phishing emails. Instead, employees may receive video messages from a supposed CEO requesting payment transfers, or voice calls mimicking trusted suppliers.
Gavin Wood, CEO, believes identity protection and human awareness will be critical:
“Human attack vectors will continue to be exploited, especially with AI-driven deepfakes, voice spoofing, phishing, and super realistic, authentic-looking videos, et cetera. Securing the human will be absolutely key for cyber security in 2026.”
Identity and access management will become one of the most important areas of cyber security, with organisations investing heavily in digital identity verification, behavioural biometrics and continuous trust authentication.
5. Supply Chain Security Becomes a Business Requirement
Supply chain security emerged as a central issue in some of the most significant cyber incidents throughout 2025. As organisations grappled with the repercussions, it became clear that robust supply chain protections are not just desirable but essential.
Elena Doncheva, highlights:
“These trends are already visible in the recent news. It is crucial every organisation is prepared to protect and respond to attacks”
Recent incidents with M&S, Harrods, Co-Op and Jaguar Land Rover put into perspective how critical supply chain is for all organisations.
Cyber security is no longer just a technical matter. It is becoming a competitive differentiator. Organisations will start to lose contracts if they cannot prove they meet minimum cyber security standards.
Tom Davies, CFO, predicts big changes:
“Procurement teams will start to look at cyber cover in the same way that they do insurance. Those without sufficient cyber cover will start to lose customers.”
Insurers and regulators are also tightening requirements, demanding proof of cyber resilience, business continuity strategies and responsible data handling practices.
In 2026, cyber maturity will be a strategic advantage.
Final Thoughts: Secure Your Organisation and Use Cyber Security as Competitive Advantage
2026 will be defined by machine-speed threats, identity risk and a widening digital attack surface. AI will be used both to launch attacks and to defend against them. Organisations that embrace AI-driven cyber defence, human-first security awareness and supply chain resilience will be best positioned for the next era of cyber risk.
Cyber security in 2026 is no longer just about protection. It is about trust, readiness and competitive strength.
Stay Secure. Security will be your edge.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.