Prove It: Why 94% Confidence and 5% Certification Cannot Both Be Right
Ninety four per cent. That’s the proportion of UK business leaders who told researchers at Elixirr they’re confident their organisation can detect and respond to a data breach or cyber attack.
Now sit that next to the UK government’s own Cyber Security Breaches Survey 2025/2026. Only 47% of businesses require two factor authentication. Just 31% have board-level responsibility for cyber security. A mere 5% hold Cyber Essentials.
These are different surveys measuring different populations, and we’re not going to pretend otherwise. But the pattern across them is impossible to ignore, and it points at exactly one thing: confidence and evidence are not the same substance.
Compliance Strips Down to One Question
Compliance has a terrible reputation. Say the word and people picture policy folders, annual audits, spreadsheets full of green boxes, and a consultant charging four figures a day to ask whether you’ve reviewed your password policy.
Strip all of that away and compliance asks something much simpler: prove it.
You say you use MFA. Prove it. Your backups are secure. Prove it. Only authorised people can access customer data. Prove it. You’d cope with ransomware. When did you last test that?
Businesses say all of these things constantly, and mean them. “We’re secure. We take cyber seriously. Our IT company handles that. Everyone’s got MFA.” Compliance doesn’t ask for confidence. It asks for evidence.
What the Government Survey Actually Shows
The Cyber Security Breaches Survey 2025/2026, published by the Department for Science, Innovation and Technology and the Home Office, draws on more than 2,100 UK businesses. It’s about as authoritative as UK cyber statistics get.
Only 34% of businesses have a policy to apply software security updates within 14 days, one of the five basic technical areas Cyber Essentials requires. Just 25% have a formal incident response plan. Board-level responsibility for cyber security sits at 31%, though that’s actually up from 27% the year before, reversing several years of decline.
And then there’s the certification figure itself. Just 5% of UK businesses hold Cyber Essentials, up from 3% the year before. Yet 24% of businesses report having technical controls in place across all five Cyber Essentials areas without ever certifying.
That last figure matters. It means a meaningful chunk of UK businesses are doing the work and simply not claiming the credit. Which is fine, if that’s a genuine choice. But it doesn’t remove the question. If we’re talking about compliance, the question is still: prove it.
Cyber Essentials Is an MOT, Not a Guarantee
A Cyber Essentials certificate doesn’t mean a business is invincible. It’s a point-in-time self-assessment against five basic technical controls: firewalls, secure configuration, user access control, malware protection, and patch management.
Think of it like an MOT. The certificate confirms that on the day you submitted the assessment, your car passed. Nothing stops you fitting a performance exhaust and racing tyres the moment you drive off the forecourt. Nothing about Cyber Essentials guarantees that six months later, those same five controls are still in place and being maintained.
That’s not a reason to dismiss the certification. It’s a reason to understand what it actually proves, and what it doesn’t.
Two Real Audits, One Very Different Story
Two recent client engagements illustrate the gap between wanting the certificate and wanting the change that earns it.
The first was a regulated professional services business. On investigation, multiple staff were using shared identities, including a shared SharePoint login used by five different people across different roles. Machines in daily use were up to twelve years old, some running with four gigabytes of RAM, already flagged internally for replacement years earlier. Every proposed control, individual accounts, supported devices, modern authentication, became a fresh negotiation.
The second was a small accountancy practice, also handling sensitive client and financial data. They needed work too. Licensing needed rationalising, identity controls needed improving, devices needed better management. But the difference wasn’t budget. It was friction. When a control was proposed and the reason explained, the business asked a question if needed, made a decision, and moved. Microsoft 365 Business Premium, conditional access, better device management, MFA, passkeys: done, done, done, done, done.
Imagine auditing both businesses six months later. At the accountancy practice: who accessed this file? Named user identities, conditional access enforced, logs available. At the professional services business: who accessed this file, historically? Nobody knows, because several people have been using the same identity, sometimes referred to jokingly as Fred, who apparently worked in accounts, conveyancing, reception and management simultaneously.
That’s not a paperwork failure. That’s the destruction of one of the most fundamental properties any security system relies on: accountability. If identity doesn’t mean identity, everything built on top of it becomes questionable.
Policy, Control, Evidence
None of this means policies don’t matter. They do, at multiple levels, but only the ones that describe a decision an organisation has actually made.
“Everyone must use MFA” is a policy. Conditional access enforcing it is the control. Sign-in logs and policy reports showing it’s actually happening are the evidence. Policy, control, evidence: that three-word chain is the entire compliance conversation.
An audit trail isn’t paperwork, it’s operational evidence. Conditional access isn’t paperwork, it’s an enforced decision. Testing a backup restore isn’t paperwork, it’s finding out whether your backup is actually a backup, before you need it to be.
What This Means for Your Business
-
Pick your five weakest claims and test them this week. MFA, backups, admin restriction, patch management, incident response. For each one, ask what evidence you could actually produce if someone asked right now.
-
Check whether you’re sharing identities anywhere. Shared logins, shared inboxes treated as user accounts, generic “office” credentials. If you can’t say definitively who did something, you’ve found your first fix, and it’s usually free.
-
Separate technical debt from compliance cost. A twelve-year-old laptop wasn’t made old by an assessment. If remediation reveals a large bill, that’s deferred maintenance finally being counted, not a surprise invoice from the auditor.
-
Read the full CSBS 2025/2026 findings for your sector. The survey breaks results down by business size and industry, and the picture for a 20-person professional services firm looks very different to a 250-person manufacturer.
-
Come back Thursday for the practical build. We’ll walk through exactly what an evidence pack should contain, so proving your controls stops being a scramble and starts being a five-minute job.
How to Turn This Into a Competitive Advantage
Procurement teams increasingly ask about security practices before signing a contract. Being able to produce evidence, not just a claim, on request is a genuine differentiator against competitors who can only offer reassurance.
The businesses in this episode who welcomed controls rather than fighting them are already ahead of that curve. Cyber Essentials becomes a formality for them, not a fire drill.
How to Sell This to Your Board
Three arguments that land with a UK board:
The government’s own survey shows only 5% of UK businesses hold Cyber Essentials, so certification is a genuine, measurable differentiator, not a compliance tax everyone already pays.
Insurers and larger clients are increasingly asking for evidence, not assurances, before they’ll do business with you. Certification and a working evidence pack are the fastest way to answer that question without a scramble.
The cost of building the evidence is mostly the cost of fixing things that were already broken. Framing it as “technical debt we’re finally addressing” is more accurate, and more persuasive, than framing it as “the price of a certificate”.