Ryvx

Short answer: not in the way most people expect. Cyber Essentials checks the IT basics of your business. It does not test how your website's own pages, forms and logins behave when someone attacks them.

What Cyber Essentials covers

Cyber Essentials is the UK government-backed scheme run by IASME. You answer a questionnaire about five controls: firewalls, secure configuration, keeping software up to date, controlling who has access to what, and protection against malware. An assessor reviews your answers. For a business with fewer than 10 staff, the basic certificate starts at £320 plus VAT.

Cyber Essentials Plus covers the same five controls, but an assessor checks them by hand. That includes testing a sample of your computers and a scan of your internet-facing systems for known weaknesses. For a micro business it typically costs from around £1,500 plus VAT.

What it leaves out

Both levels look at your organisation's devices and settings. Neither one sits down and tries to break your website. A scan can spot an out-of-date server, but it will not notice that a customer can see another customer's order by changing a number in the address bar, or that your contact form lets someone send emails as you.

Those problems live in the website itself, and you only find them by testing the site the way an attacker would: signing in, filling in the forms, calling the APIs behind the pages, and seeing what they let you do.

Do you need both?

Often, yes. Cyber Essentials is a good baseline, and some public-sector contracts require it. If your website takes logins, payments or customer data, a website test covers ground the certificate does not. The two answer different questions: Cyber Essentials asks whether your office IT is set up sensibly, and a website test asks whether someone can break into what your customers use.

A Ryvx review tests the website or app itself, at a fixed £495 per site, with proof on every finding and a person checking every report. It is not Cyber Essentials, and it does not replace it.