Cyber Essentials 75% Discount: £80 to £125 Until March 2027

The government has cut the price of a first Cyber Essentials certificate by 75% for small and medium-sized firms, so the basic certificate now costs £80 to £125 plus VAT until the end of March 2027. In the same fortnight, a tool many IT providers use to manage their clients’ computers was taken offline after more than 30 unpatched flaws were published, Microsoft fixed an Outlook flaw already used in attacks, and SonicWall and Barracuda patched exploited flaws in their firewall and email security products.

Cyber Essentials is 75% off for firms certifying for the first time

On 3 November the Department for Science, Innovation and Technology announced the Cyber Essentials First Step Fund, which takes 75% off the cost of a Cyber Essentials certificate for micro, small and medium-sized organisations. IASME, the government’s delivery partner for the scheme, says it applies to UK organisations that have not held Cyber Essentials in the last four years, and that you must register and buy your assessment by 31 March 2027, or before the funding runs out. The discount still applies if you certify through a certification body rather than directly.

IASME’s list prices are £320 plus VAT for 0 to 9 staff, £440 for 10 to 49 and £500 for 50 to 249, so the discounted fees work out at £80, £110 and £125 plus VAT. The funding pays for the assessment and, if you pass, the certificate; it does not guarantee a pass. A second scheme gives selected suppliers of companies that have signed the government’s Cyber Resilience Pledge a free certificate plus help from an NCSC-assured Cyber Advisor, but your customer has to nominate you for that one.

For a small firm this removes the last cost argument against certifying. The fee was never the expensive part: the work to meet the five controls, including multi-factor sign-in on every cloud service, is. Certifying the whole organisation with a turnover under £20m still brings the free cyber liability cover explained in our guide to the free Cyber Essentials insurance, and our Cyber Essentials explainer covers what the assessment checks. Sources: GOV.UK announcement, funding package details and IASME’s prices.

N-able N-central: ask your IT provider whether it uses it

N-central is remote monitoring and management software that managed service providers use to look after their clients’ computers and networks from one console. Late on Sunday 8 November a security researcher, Sean Bales, published details and working exploit code for more than 30 flaws in it without telling N-able first. On 9 November N-able took its hosted N-central service offline across the Americas, Europe and Asia-Pacific and told customers running their own N-central servers to take them offline too. It released a fix, N-central 2026.4 HF2, on 10 November, said every flaw that could be exploited without logging in had been fixed, and brought the hosted service back online. Attackers were already scanning for exposed servers.

It did not end there. On 12 November the same researcher published two more exploits, one of which, 4EverAble2Shell, he says works against the HF2 release. BleepingComputer reported that researchers had seen it used within hours to install cryptocurrency miners on at least 21 servers, 19 of them running the latest update. That exploit needs N-central’s Legacy API to be switched on, which it is not by default, and N-able has disabled its Intune integration as a precaution while it works on further fixes.

Why it matters if you have never heard of N-central: software like this has administrator access to every device it manages, so a compromised server at your IT provider is a route into your business. If someone else runs your IT, ask them this week whether they use N-central, whether it is on the latest hotfix with Legacy API off, and whether they have checked it for signs of a break-in. Our page on managed cyber security services covers what you should expect a provider to tell you. Sources: BleepingComputer on the shutdown and SecurityWeek on the fixes.

Outlook flaw used in attacks, fixed on Patch Tuesday

Microsoft’s November updates, released on 10 November, fix more than 1,000 security flaws (BleepingComputer counts 1,235, SecurityWeek 1,094, because they count differently). One of them, CVE-2026-124194 in Outlook, was already being exploited. An attacker sends a file and persuades someone to open it in Outlook; Outlook then connects to the attacker’s server without its usual warning about external content and hands over the user’s NTLMv2 password hash, which can be used to sign in as that person. Opening the email in the preview pane is not enough to trigger it. Microsoft rates it moderate, and the affected versions are Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.

The month’s updates also include critical fixes for Windows 10 and 11, Windows Server, Office and Exchange Server, so the simple answer is to let the November updates install on every machine now. Our patch deadline calculator works out the 14-day Cyber Essentials deadline for critical and high-risk fixes, and our explainer on phishing attacks covers the “open this file” trick this flaw depends on. Sources: Microsoft’s advisory, BleepingComputer and SecurityWeek.

SonicWall VPN flaw lets attackers skip multi-factor sign-in

On Friday 6 November SonicWall fixed seven flaws in SonicOS, the software on its firewalls, and warned that one of them, CVE-2026-19868, may have been exploited. It affects the SSL-VPN when it is set up to sign users in through SAML: someone with valid credentials for a different sign-in method can get past the SAML step, including multi-factor authentication enforced through it. CISA added it to its list of exploited flaws the same day. Affected versions are Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier; the fixes are 7.3.4-7013 and 8.2.3-8015, and SonicWall says there is no workaround.

This one matters for insurance as much as security. Almost every cyber proposal form asks whether remote access is protected by multi-factor sign-in, and a flaw that bypasses it means the answer you gave is no longer true until the firewall is updated. Our guide to network security for small businesses covers what insurers expect at the edge of your network. Sources: BleepingComputer and the CISA catalogue.

Barracuda email security gateways: two chained flaws now exploited

On 2 November Barracuda fixed two flaws that can be chained to get root access to its appliances: CVE-2026-116606, an authentication bypass in the Email Security Gateway scored 9.3, and CVE-2026-111560, a command injection flaw scored 8.6 that also affects its Load Balancer ADC, Web Application Firewall, Web Security Gateway and Message Archiver. On 10 November CISA added both to its exploited list and told US agencies to patch within three days. If you or your IT provider run a Barracuda appliance, check it has the update and that its admin interface cannot be reached from the internet. Source: SecurityWeek.