On 22 July 2026, Proofpoint published its 2026 AI-Era Ransomware Report, and the UK figures inside it reframe how every British business should think about ransomware. Of UK organisations hit by ransomware in the past year, 58% paid a ransom — above the 54% global average, and paid despite the National Cyber Security Centre’s long-standing guidance that organisations should not. 65% of affected UK organisations said artificial intelligence had increased the effectiveness of the attack against them, 66% had data stolen during the incident, and 22% of those who paid were then hit with a second extortion demand. The research draws on a survey of 953 full-time security professionals across 12 countries and 20 industries, conducted in March and April 2026 — a broad, current sample rather than a single vendor’s incident book.

The report’s central argument is not that AI has invented a new kind of malware. It is that AI has made the human stages of an attack — the phishing email, the convincing pretext, the credential-harvesting page, the Business Email Compromise message — dramatically more successful. As Proofpoint’s Chief Strategy Officer Ryan Kalember put it: “AI hasn’t fundamentally changed ransomware, but it has materially improved the attacks that lead to ransomware.” Modern ransomware, in other words, is increasingly a human problem, not a malware problem — it begins with people, identities and trusted communications, and only ends with encryption. This briefing sets out what Proofpoint found, why the UK payment rate sits above the global average, and why the five Cyber Essentials controls map almost exactly onto the entry vectors the report identifies — a mapping that matters all the more given that only 5% of UK businesses hold the certification.

58%

UK organisations that paid a ransom after a ransomware attack — above the 54% global average (Proofpoint 2026 AI-Era Ransomware Report)

65%

UK organisations affected that said AI increased the attack’s effectiveness — 31% significantly, 33% somewhat

66%

UK organisations that had data stolen during the incident, before or alongside encryption

22%

UK organisations that paid and were then hit with a second extortion demand

What Proofpoint actually reported

Proofpoint is one of the largest email-security and human-risk vendors in the world, and its threat research carries weight precisely because email and social engineering are where the overwhelming majority of intrusions begin. The 2026 AI-Era Ransomware Report, released on 22 July 2026, is built on a survey of 953 security professionals across 12 countries and 20 industries, fielded in March and April 2026. Rather than counting malware samples, it asks the people who defend real organisations how attacks reached them, what role AI played, and what happened afterwards — a view of the attack that starts at the human perimeter rather than the endpoint.

The global picture is sobering enough: 54% of affected organisations paid a ransom, 65% said AI increased the attack’s effectiveness, and 65% had data stolen. But the report’s power is in the country-level detail. In the UK the payment rate rises to 58%, data theft to 66%, and second-extortion-after-payment to 22%. At the extreme end of the scale sits the United States, where 93% of affected organisations paid — a figure that underlines how far payment has become normalised in some markets. The UK sits above the global mean but well below the US, which is the uncomfortable middle ground of a country that is heavily digitised but unevenly defended.

The mechanism the report describes is what makes the numbers actionable. Ransomware, Proofpoint argues, rarely begins with a technical exploit against a server. It begins with a person. Globally, 34% of incidents started with phishing or email social engineering, 47% involved malicious links, 46% malicious attachments, 36% credential harvesting and 35% Business Email Compromise. In the UK the primary entry vectors were malicious links (40%), Business Email Compromise (35%), and malicious attachments and credential harvesting at 32% each. AI supercharges every one of these, because every one depends on a human being persuaded that something illegitimate is legitimate — and 40% of UK respondents said their staff did not suspect the attack precisely because it appeared authentic.

Why “a human problem, not a malware problem” changes your defence

For a decade, UK SMEs have equated ransomware defence with anti-virus, backups and endpoint tooling — the machinery of the encryption stage. Proofpoint’s data shows why that framing now leaves the front door open. The attack is won or lost long before any file is encrypted: at the moment an employee clicks a malicious link, opens a weaponised attachment, enters credentials into a convincing fake, or acts on a fraudulent instruction that appears to come from a colleague or supplier. AI has made those moments far harder to spot — 40% of UK respondents said staff didn’t suspect the attack because it looked authentic, and 31% attributed the breach to users interacting with malicious content. If your entire ransomware strategy is about recovering encrypted machines, you are defending the last five minutes of an attack that was decided in the first five. The controls that matter now govern identity, access, configuration and the human perimeter — which is exactly the ground Cyber Essentials covers.

How the AI-era ransomware picture developed

The Proofpoint report did not land in a vacuum. It caps a run of 2026 developments — regulatory, criminal and technical — that all point the same way: attackers are using automation and AI to make the human stages of intrusion more convincing, while the UK’s baseline of formal cyber hygiene remains thin. The timeline below sets out the chronology that frames the report.

27 April 2026 — Cyber Essentials v3.3 comes into force

The updated Cyber Essentials requirements take effect, adding an automatic assessment failure for cloud services without multi-factor authentication, reinforcing the 14-day patch mandate for critical vulnerabilities, and requiring documented patch-compliance evidence for the Cyber Essentials Plus audit — controls that map directly onto the entry vectors Proofpoint later quantifies.

March–April 2026 — Proofpoint fields the survey

Proofpoint surveys 953 full-time security professionals across 12 countries and 20 industries, asking how ransomware reached them, what role AI played, whether they paid, and whether data was stolen — the dataset behind the AI-Era Ransomware Report.

Across 2025–2026 — NCSC records a surge in significant incidents

The National Cyber Security Centre handles 204 nationally significant incidents in 2025, more than double the 89 recorded the year before — a step-change in the tempo of serious cyber activity affecting UK organisations.

Mid-2026 — AI-assisted social engineering goes mainstream

Threat researchers document generative AI being used to write flawless, context-aware phishing emails, clone writing styles for Business Email Compromise, and build convincing credential-harvesting pages at scale — removing the spelling errors and awkward phrasing that once betrayed a scam.

July 2026 — Social-engineering convictions underline the human vector

High-profile sentencing in the Transport for London breach demonstrates in a UK court that social engineering — not zero-day exploits — is how major intrusions now begin, reinforcing the shift Proofpoint quantifies.

22 July 2026 — Proofpoint publishes the report

Proofpoint releases the 2026 AI-Era Ransomware Report, quantifying that 65% of affected organisations globally say AI increased attack effectiveness, that 58% of UK victims paid, and that 66% of UK victims had data stolen — framing ransomware as a human, identity and communications problem.

24 July 2026 — UK payment rate draws scrutiny

UK commentary highlights that nearly six in ten British victims paid despite explicit NCSC guidance not to, and that the 22% who then faced a second extortion demand illustrate why payment rarely ends the incident.

How ransomware actually gets in: the entry vectors

The most operationally useful part of the Proofpoint report is its breakdown of how attacks begin. These are not exotic exploits — they are the everyday channels of business communication, weaponised. The chart below shows the primary entry vectors, combining the UK-specific figures with the global breakdown for context. Every bar represents a human interaction that AI now makes more convincing.

Malicious links (47% global / 40% UK)

47%

Malicious attachments (46% global / 32% UK)

46%

Credential harvesting (36% global / 32% UK)

36%

Business Email Compromise (35% global / 35% UK)

35%

Phishing / email social engineering (34% global)

34%

Users interacting with malicious content (31% UK)

31%

Staff didn’t suspect — attack appeared authentic (40% UK)

40%

Read the chart as a single sentence: every leading entry vector is a human being persuaded to trust something they should not. Malicious links and attachments arrive by email and are opened because they look routine. Credential harvesting works because a fake login page is now visually indistinguishable from the real one. Business Email Compromise succeeds because an instruction appears to come from a trusted colleague or supplier, in their voice and their style — a style AI can now reproduce from a handful of public messages. The final bar is the whole thesis of the report: in 40% of UK cases, staff did not suspect the attack because it appeared authentic. That is not a training failure to be scolded away; it is the predictable result of AI raising the quality of the lure faster than human intuition can adapt.

The number that defines the UK problem: data theft

One statistic in the UK data deserves particular attention, because it changes the calculus of paying a ransom entirely. In the old model of ransomware, encryption was the leverage: pay, and you get your files back. In the model Proofpoint documents, the data is stolen first — and in the UK that happened in 66% of incidents, meaning the attacker holds a copy of your information regardless of whether you ever pay.

66% of UK ransomware victims had data stolen during the incident. Because the data leaves the building before encryption, paying a ransom no longer guarantees the problem is over — it is precisely why 22% of UK organisations that paid were then hit with a second extortion demand.

Data theft is why payment so rarely closes the incident. Once an attacker has a copy of your customer records, financials or intellectual property, the encryption key is only half of what they are selling — the other half is a promise not to publish or resell the data, a promise a criminal has every incentive to break. That is the mechanism behind the 22% of UK payers who faced a second demand (against 37% globally). It also carries a regulatory sting: stolen personal data is a reportable breach under UK GDPR, with Information Commissioner’s Office obligations and potential penalties that arrive whether or not the ransom is paid. For a UK SME, the practical lesson is stark — the only reliable defence is to prevent the intrusion that lets the data walk out in the first place, because once it has gone, no payment reliably brings it back.

Where UK SMEs are most exposed to AI-era attacks

The Proofpoint findings are, in effect, a stress test of exactly the controls Cyber Essentials sets out — user access control, secure configuration, malware protection and, above all, the human and identity layers that AI-assisted social engineering targets. Most UK SMEs fail that test in a small number of predictable places. The grid below maps where the exposure concentrates for a typical mid-market business.

Common exposure gaps against AI-assisted, human-centric attacks

No MFA on email, cloud services and remote-access accountsHigh

Staff unable to recognise AI-crafted phishing and BECHigh

No verification process for payment or supplier-change requestsHigh

Malicious links and attachments not filtered at the email gatewayHigh

Shared or over-privileged accounts with broad data accessHigh

No immutable, off-site backup to recover without payingMid

Critical vulnerabilities not patched within the 14-day windowMid

No documented incident and breach-notification planMid

The pattern is consistent, and it is telling that the highest-severity gaps cluster around identity and the human perimeter rather than the endpoint. An AI-assisted attacker does not need a sophisticated exploit; it needs one employee to trust one convincing message and one account without a second factor. Multi-factor authentication is the single control that most reliably breaks the chain, because even a perfectly harvested credential is useless without the second factor — which is exactly why Cyber Essentials v3.3 now makes an absent MFA on cloud services an automatic failure. The verification process for payment and supplier changes is the human equivalent: a simple, mandatory out-of-band check that defeats even a flawless Business Email Compromise message. None of these are expensive. They are disciplines, and their absence is why so many UK organisations end up in the 58% who pay.

What Cyber Essentials certification costs by business size

Cyber Essentials is deliberately proportionate — the scheme is built for organisations of every size, and the cost of certification scales with the complexity of the estate rather than headcount alone. The table below sets out an indicative view of what certification and the underlying remediation typically involve across UK business-size bands. Figures are illustrative planning ranges for the combined certification and readiness work, not fixed quotes.

Business size	Typical estate in scope	Certification path	Indicative investment
1–10 staff	Cloud email and productivity suite, a single firewall, a handful of endpoints, one or two SaaS tools	Cyber Essentials self-assessment, with MFA rollout and phishing-awareness basics	£500–£2,000
10–50 staff	Multiple cloud services, mixed device fleet, remote workers, finance and payment workflows	Cyber Essentials or CE Plus with hands-on audit, MFA enforcement and email-gateway controls	£2,000–£7,000
50–200 staff	Multi-site estate, servers, several SaaS platforms, supplier integrations, richer data holdings	CE Plus with vulnerability scanning, access-control review and a remediation programme	£7,000–£18,000
200+ staff	Complex estate, regulated or personal data at scale, contractual security obligations, supply-chain scope	CE Plus plus continuous identity governance, phishing simulation and board oversight	£18,000+

The right figure for any given business depends on the starting state of the estate — an organisation that already enforces MFA and filters email robustly will spend far less than one starting from shared accounts and no gateway controls. But the direction of travel is the same across every band: the cost of certification and the disciplined controls behind it is a fraction of the cost of a ransomware incident, let alone a paid ransom followed by a second demand. With the annual cost of cyberattacks to the UK economy estimated at £14.7 billion, and only 5% of UK businesses holding Cyber Essentials (up from 3% in the previous Cyber Security Breaches Survey), the certification remains both the clearest signal of baseline competence and, structurally, the difference between defending the human perimeter and leaving it open.

Reactive posture versus a certified, human-aware posture

The Proofpoint data exposes the gap between treating ransomware as a recovery problem and treating it as a prevention problem rooted in people, identity and communications — which is exactly what Cyber Essentials formalises. The comparison below sets out the two postures.

Reactive posture

How most uncertified SMEs run today

Ransomware defence equated with anti-virus and backups alone
MFA optional or missing on email and cloud services
Staff untrained against AI-crafted phishing and BEC
Payment and supplier-change requests actioned on trust
Broad, shared accounts with wide access to data
Recovery plan assumes paying is a viable last resort
Security treated as an IT cost, not a board responsibility

Certified, human-aware posture

Where Cloudswitched takes you

Defence starts at the human and identity perimeter, not the endpoint
MFA enforced across email, cloud and remote access
Ongoing phishing awareness and simulation for staff
Mandatory out-of-band verification for payments and changes
Least-privilege access limits what any one account can reach
Immutable, off-site backups remove the need to pay
Board-level ownership of cyber resilience and breach readiness

Moving from the left column to the right is not a single purchase; it is a shift from defending the encryption stage to defending the human stages where the attack is actually won or lost. Cyber Essentials is the framework that makes that shift concrete and auditable, and the v3.3 rules that took effect on 27 April 2026 sharpen it further — an automatic failure for cloud services without MFA, a firm 14-day patch mandate, and documented evidence for the CE Plus audit. Those are not bureaucratic hurdles. They are, almost line for line, the controls that neutralise the entry vectors Proofpoint measured.

Illustrative human-perimeter readiness score (out of 100) for a typical uncertified UK SME — partial MFA, untrained staff against AI-crafted lures, no payment-verification process. A planning benchmark, not a measured figure; certification and awareness are what move the needle.

A practical first move for any board this week

You do not need to start with a certification application. The single most valuable exercise a UK SME can run this week is a human-perimeter review: confirm that multi-factor authentication is enforced — not merely available — on every email and cloud account, including administrators and remote workers; write down the exact steps a staff member must follow before actioning any payment or supplier bank-detail change, and require an out-of-band check (a phone call to a known number) for each; and run a single, honest test of whether your people can spot a well-crafted phishing email. Then check that at least one backup is genuinely immutable and off-site, so recovery never depends on paying. Most businesses cannot confirm all of these today, and discovering that is the point: it converts an invisible human exposure into a managed one, and it is the natural first step toward Cyber Essentials.

At-a-glance: the Proofpoint 2026 AI-Era Ransomware Report

Fact	Detail
Source	Proofpoint 2026 AI-Era Ransomware Report, published 22 July 2026
Survey base	953 full-time security professionals, 12 countries, 20 industries, March–April 2026
UK ransom payment rate	58% of affected UK organisations paid — above the 54% global average
US comparison	93% of affected US organisations paid
AI effectiveness	65% of UK organisations affected said AI increased the attack’s effectiveness
Data theft	66% of UK victims had data stolen during the incident
Second extortion	22% of UK payers faced a second demand (37% globally)
Human-perimeter tell	40% of UK respondents said staff didn’t suspect the attack because it appeared authentic
UK entry vectors	Malicious links 40%, BEC 35%, malicious attachments 32%, credential harvesting 32%
Global entry vectors	Malicious links 47%, attachments 46%, credential harvesting 36%, BEC 35%, phishing/email 34%
Key quote	Ryan Kalember: “AI hasn’t fundamentally changed ransomware, but it has materially improved the attacks that lead to ransomware.”
NCSC incidents	204 nationally significant incidents in 2025, up from 89
Relevant standard	Cyber Essentials v3.3, in force 27 April 2026 — MFA auto-fail for cloud, 14-day patch mandate
UK certification rate	Only 5% of UK businesses hold Cyber Essentials (up from 3%)
Economic cost	Cyberattacks cost the UK economy an estimated £14.7bn a year

How this connects to the wider 2026 threat picture

The Proofpoint report does not stand alone. It is the latest thread in a year of UK developments all pointing the same way: the attacker is increasingly automated and AI-assisted, the decisive intrusion happens at the human perimeter, and the weakest link is an unverified identity or an untrained employee. The report’s framing — ransomware as a people, identity and communications problem — is the analytical face of a broader shift toward faster, more convincing, human-targeted compromise.

The social-engineering dimension Proofpoint quantifies is exactly the exposure we set out in our coverage of the Scattered Spider sentencing over the Transport for London breach, where a UK court confirmed that trusted-contact manipulation, not a zero-day, was the way in. The ransomware economics behind the payment rate are examined in our analysis of the Check Point June 2026 report and The Gentlemen’s device-centric model, the technical counterpart to the human vector this report describes. The patching discipline that underpins Cyber Essentials — and that a 14-day mandate now enforces — is captured in our reporting on the AI-driven CVE surge and why a real patch programme matters and in our coverage of the record-breaking July 2026 Patch Tuesday and its SharePoint and AD FS zero-days. And the way AI itself is now both weapon and regulated technology runs through our look at the EU AI Act deadline and its implications for UK SMEs. Together these establish the same message the Proofpoint report makes concrete: in an AI-era threat landscape, the basics — MFA, access control, secure configuration, awareness and evidenced patching — are the whole game, and Cyber Essentials is the framework that enforces them.

Ransomware is now a human problem — defend the human perimeter

Proofpoint’s data shows the attack is won or lost before any file is encrypted, at the identity and communications layer AI now targets so effectively. Cyber Essentials is the framework built to close exactly those gaps — enforced MFA, access control, secure configuration and malware protection. Cloudswitched delivers end-to-end certification — gap analysis, remediation and audit — so those controls are real, evidenced and maintained, not just aspirational.

Talk to us about Cyber Essentials Certification

Frequently asked questions

Why did 58% of UK organisations pay a ransom despite NCSC guidance not to?

The NCSC has consistently advised organisations not to pay ransoms, because payment funds the criminal ecosystem, marks you as willing to pay again, and does not reliably return your data. Yet 58% of affected UK organisations paid — above the 54% global average — because in the moment of an incident the pressure is immense: operations are down, customer data may already be stolen, and the attacker offers what feels like the fastest route back. The Proofpoint data shows why that instinct is misplaced: 66% of UK victims had data stolen before encryption, so paying does not undo the theft, and 22% of those who paid were hit with a second demand. Payment treats the symptom while leaving the disease. The only reliable defence is to prevent the intrusion — through MFA, access control, staff awareness and immutable backups — so that paying is never the least-bad option on the table.

What does “AI made the attack more effective” actually mean in practice?

It means the human-facing parts of the attack have become far harder to spot. Generative AI can write a phishing email in flawless business English, tailored to your industry and free of the spelling errors and awkward phrasing that once gave scams away. It can clone a colleague’s or supplier’s writing style from a few public messages to make a Business Email Compromise instruction convincing, and it can build a credential-harvesting page that is visually indistinguishable from a real login screen. Proofpoint found that 65% of affected UK organisations said AI increased effectiveness, and 40% said staff did not suspect the attack because it appeared authentic. Ryan Kalember’s framing is precise: AI has not changed the ransomware itself, but it has materially improved the attacks that lead to ransomware — the phishing, the malware scripts, the credential theft that exploit human trust at scale.

If ransomware is a “human problem”, does technology still matter?

Yes — but the technology that matters most is the technology that governs identity and access, not the technology that cleans up afterwards. The point of calling ransomware a human problem is that the decisive moment is a person being persuaded to trust something illegitimate, so the highest-value controls are the ones that limit what that mistake can cost. Multi-factor authentication means a harvested credential alone cannot be used. Least-privilege access means a compromised account cannot reach everything. Email-gateway filtering removes many malicious links and attachments before they reach a person. Immutable backups mean you can recover without paying. Anti-virus and endpoint tools still have a role, but they defend the encryption stage — the last five minutes of an attack decided in the first five. A balanced defence puts more weight on the identity and communications layer, which is exactly where Cyber Essentials focuses.

How does Cyber Essentials specifically address these entry vectors?

Cyber Essentials is built around five technical controls, and they map almost directly onto the entry vectors Proofpoint identified. User access control — strengthened in v3.3 with an automatic failure for cloud services without MFA — defeats credential harvesting, because a stolen password is not enough on its own. Malware protection and secure configuration reduce the impact of malicious links and attachments. Firewalls and secure configuration limit what an attacker can reach once inside. Patch management, with its 14-day mandate for critical vulnerabilities, closes the technical gaps that follow the initial human compromise. Business Email Compromise is addressed by the access-control and process disciplines the framework encourages, including verification of sensitive requests. No single control stops every attack, but together the five remove the easy paths that the 58% of UK payers left open. Certification is the mechanism that turns those controls from good intentions into verified, maintained practice.

We already train staff on phishing — why are attacks still getting through?

Because the lures have improved faster than traditional training assumes. Older phishing awareness taught people to look for tell-tail signs: poor spelling, generic greetings, mismatched addresses, urgency. AI has removed most of those signals — the email is now grammatically perfect, personally addressed, contextually accurate and written in a familiar voice. Proofpoint’s finding that 40% of UK staff did not suspect the attack because it appeared authentic is the direct consequence. Effective defence therefore cannot rely on spotting a bad email alone; it needs structural backstops that work even when a good employee is fooled. Enforced MFA, mandatory out-of-band verification for payments and supplier changes, least-privilege access and email-gateway filtering all keep working when human judgement fails. Awareness training remains valuable, but it must be paired with controls that assume some lures will succeed — which is the posture Cyber Essentials builds toward.

Should we ever pay a ransom?

The NCSC advises against it, and the Proofpoint data explains why in hard numbers. Paying does not undo data theft — and 66% of UK victims had data stolen — so a copy of your information remains in criminal hands regardless. Paying also identifies you as willing to pay: 22% of UK organisations that paid were hit with a second extortion demand. And payment may carry legal and regulatory complications, particularly where sanctioned entities are involved. The better question is how to make sure you are never forced to consider it. That means immutable, off-site backups so you can recover encrypted systems without the key; a tested incident-response and breach-notification plan so you act calmly rather than under duress; and the preventative controls that stop the intrusion in the first place. If your only recovery strategy is paying, you have already lost the negotiation; the work to avoid that position happens long before an incident.

What changed in Cyber Essentials v3.3, and does it affect us?

Cyber Essentials v3.3 came into force on 27 April 2026 and tightened several requirements that map directly onto the Proofpoint findings. The most significant change is an automatic assessment failure for any cloud service without multi-factor authentication — MFA is now a pass/fail condition, not a recommendation, which matters because credential harvesting was a top UK entry vector at 32%. The update also reinforces the 14-day patch mandate for critical vulnerabilities and, for the Cyber Essentials Plus audit, requires documented patch-compliance evidence rather than a simple attestation. If you are certified or planning to certify, these changes affect you directly: you will need enforced MFA across cloud services and a genuine, evidenced patch cadence. If you are not yet certified, they set the bar you should aim at regardless, because they encode the controls that defend against AI-assisted, human-centric attacks.

Why does the UK pay more often than the global average but far less than the US?

The Proofpoint report does not attribute the gap to a single cause, but the pattern is instructive. The United States, at 93%, has the most normalised ransom-payment culture — driven by cyber-insurance dynamics, a large base of high-revenue targets and a legal environment where paying is often treated as a commercial decision. The global average sits at 54%. The UK, at 58%, is above that mean, which is uncomfortable given explicit NCSC guidance not to pay, and it reflects a business base that is heavily digitised but unevenly defended: many organisations reach the point of an incident without the backups, access controls and rehearsed plans that would let them refuse. The encouraging read is that the UK figure is well below the US, suggesting the guidance has traction — and that closing the certification gap, where only 5% of UK businesses hold Cyber Essentials, is the lever most likely to bring the payment rate down further.

Does Cyber Essentials help us win contracts as well as improve security?

Yes, and increasingly so. Cyber Essentials is already mandatory for many UK government contracts, and the requirement is spreading through private-sector supply chains as larger organisations seek assurance that their suppliers will not be the weak link. Holding the certification does double duty: it closes the identity, access and configuration gaps that AI-era attacks exploit, and it provides recognised, independent proof of baseline competence that customers and insurers now look for. For a growing SME, that makes it as much a commercial credential as a security one — a way to qualify for tenders, satisfy supplier-assurance questionnaires and often reduce cyber-insurance friction. In a market where 66% of UK ransomware victims had data stolen, being able to demonstrate a certified security baseline is a genuine competitive advantage, not just a defensive necessity.

How does Cloudswitched help us respond to this?

Cloudswitched delivers Cyber Essentials and Cyber Essentials Plus as a managed, end-to-end service rather than a box-ticking exercise. We begin with a gap analysis against the five controls and the v3.3 rules, identifying every account without MFA, every over-privileged or shared login, and every gap in email filtering, patching and configuration. Our engineers then do the remediation — enforcing MFA across cloud and remote access, tightening access to least privilege, hardening configurations, closing patch gaps inside the mandated window and putting immutable, off-site backups in place — before coordinating the assessment or hands-on Plus audit and preparing the documented evidence the audit now requires. Because we are an established IT company rather than a certification-only consultancy, we can also put ongoing phishing awareness, payment-verification processes and named ownership behind the certificate, so the human perimeter stays defended after the badge is issued. The outcome is a business defended where AI-era attacks actually strike — at people, identities and trusted communications — with the evidence to prove it to customers and auditors alike.

Close the gap before the next convincing email arrives

58% of UK ransomware victims paid, 66% had data stolen and 40% of staff never suspected a thing — because AI made the attack look authentic. Cloudswitched turns Cyber Essentials into a real, maintained programme — enforced MFA, least-privilege access, secure configuration, email filtering, evidenced patching and immutable backups — so your business is defended at the human perimeter where these attacks are won or lost.

Talk to us about Cyber Essentials Certification

Tags:Cyber EssentialsCyber SecurityIT SupportNetwork Admin

CloudSwitched

London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.

CloudSwitched Service

Cyber Essentials Certification

End-to-end Cyber Essentials Plus certification and ongoing security services for UK businesses

Learn More