Cyber Essentials Plus audits five baseline controls on sampled devices; a penetration test tries to get in. What each covers, where they overlap, which to do first, and how to run both without paying twice.
A penetration test is a controlled, authorised attempt to break into your systems so you find the weaknesses first. How it differs from a vulnerability scan, the types of test, the process from scoping to retest, and what a good report looks like.
CREST and The Cyber Scheme certify UK penetration testers; CHECK is the NCSC scheme for testing government systems. What CSTM, CSTL, CRT and CCT involve, how they map to each other, and how they lead to UK Cyber Security Council titles and CHECK status.
Most infrastructure penetration tests are won by the same five weaknesses: unpatched systems, weak authentication, exposed management interfaces, flat networks and cleartext protocols. How each shows up, what it lets an attacker do, and what fixes it.
The OWASP Top 10 2025 keeps broken access control at number one, moves security misconfiguration to second and adds software supply chain failures and mishandling of exceptional conditions. Each category explained from a penetration tester’s point of view, with what fixes it.
