Cyber Made Simple
See what a bad day would cost. Fix it in minutes a week. Prove it with one link.
Know what a bad day would cost your business, fix it in minutes a week, and prove it with one link.
See it
Five plain questions give you a cost range for a bad day, built from the Government's Cyber Security Breaches Survey and from what the ICO has fined people. Nineteen more questions find the gaps behind that number and put them in order, worst first.
Fix it
Short jobs each week, sized for the time you have rather than for a project team. Ready-made policies and incident plans, staff training, and practice phishing emails. Every job shows what it takes off your risk.
Prove it
Being safe and being able to show it are two different jobs, and the second one is what wins or loses contracts. Everything you do leaves proof behind: a badge, a page you can share, a drafted answer to a customer's security questionnaire.
Everything in Cyber Made Simple today
Listed because it exists in the build, not because it is on a roadmap. Anything still being written is described as such in the words further down, never as a bullet with an icon beside it. Anything in a plan that is not on sale yet says so in its own description.
Understand
A number in pounds is the only thing on this page that changes somebody's mind in under two minutes, so it comes first.
Risk in pounds, not a score out of a hundred
Five plain questions return a range in pounds. Not a prediction and not a score, and not a single figure either: it breaks into where it comes from, which is downtime, getting back up and running, a data breach and the ICO, payment and invoice fraud, and the customers who do not come back. Anchored to the Government's Cyber Security Breaches Survey and to ICO enforcement data, with the working one tap away.
Nineteen questions that rank the fixes
A risk self-assessment finds the biggest gaps and orders them, each one shrinking the number the calculator just produced.
Breach checking
For an email address or a whole business domain, so exposure that already exists is found before it is used.
External attack surface scanning
What your business shows to the outside world, seen from the outside. Part of Business Plus, which is not on sale yet.
Look-alike domain monitoring
The near-miss spellings of your own domain that somebody would register to impersonate you.
Email spoofing and deliverability checks
Whether somebody can send mail that appears to come from you, and whether your own mail arrives.
Continuous breach monitoring
Your team's addresses watched over time, with an alert when new exposure appears rather than a check you have to remember to run. Part of Business Plus, which is not on sale yet.
Peer benchmarking and a UK risk map
What normal looks like for your sector and size, which is the context an owner needs before deciding what to spend.
An assistant grounded in UK guidance
For the moment somebody is not sure what a term means or what to do next, answering from UK guidance rather than from anywhere.
Act
A weekly list, not a programme. The plan still works when a busy month means you do none of it.
This Week
A short, prioritised set of actions with the working shown: what to do, how long it takes, and roughly how much exposure it removes.
Business Moments
The events a business recognises, somebody joined, a new laptop, a big customer, turned into exactly the actions those events require and nothing else.
Staff awareness that changes behaviour
Short courses with quizzes and completion certificates, plus a gap analyser showing where the training is not landing.
Phishing recognition without sending anything
Staff work through real-looking phishing emails in the browser and the owner sees who would have been caught. Nothing is sent, so there is no sender to allow-list and nothing to explain to the IT provider. Part of Business Plus, which is not on sale yet.
Plans that exist before they are needed
Incident response and business continuity workspaces, written in advance rather than during.
Tabletop exercises
A way to test those plans while it is still only an exercise. Part of Business Plus, which is not on sale yet.
A guided path for the day it matters
When something is actually happening, a route through it rather than a document to go and find.
Prove
Being secure and being able to show it are different jobs, and the second one is what wins or loses contracts.
A Trust Page instead of a questionnaire
One shareable link carrying your strengths, each labelled with how it was checked: verified by observation, independently certified, or stated by your organisation. It will never show scores or gaps, and that policy is the point.
Cyber Essentials readiness
Tracked question by question against the current question set, with a v3.2 to v3.3 delta checker for anybody already certified.
ISO 27001 readiness
An assessment for firms heading towards the standard.
A framework selector
For firms that do not yet know which standard applies to them.
UK regulatory obligation mapper
What actually applies to you, including the Cyber Security and Resilience Bill.
An insurance evidence pack
Policies, assessments, certificates and plans compiled and branded for a broker, assembled once from what you already hold.
Supplier questionnaires, both directions
A questionnaire builder for when you are the customer, a vendor scorecard and supplier register for third-party risk, and drafted answers to an inbound customer security questionnaire. Part of Business Plus, which is not on sale yet.
What is true here that is not true elsewhere
Written for the businesses the industry ignores
The mission is to give a UK small business the security that until now only a company with an IT department could buy. Not a watered-down version: the same controls and the same evidence, explained in words the buyer already knows.
Plain English is treated as a security control
Advice nobody understands protects nobody. There are no scores out of a hundred, no acronyms without explanation, and the reasoning behind every number is published.
Nothing to install and nothing to hand over
No agents on your machines, no admin access to your systems, no credentials. The platform works from what you tell it and what can be observed from the outside, which means we hold no passwords for your systems and no access to them.
Honesty is enforced in the product
Plan labels are derived from the live product registry rather than typed by hand, capability that is advertised but not yet shipped is marked as such, and the accessibility position is published against WCAG 2.2 AA rather than claimed.
A free layer for individuals and families, permanently
Breach checking, password strength and generation, the scam assistant, safe shopping checks and social privacy check-ups stay free, with no account walls added later, no data resold, and analytics only if you agree to them. Every business is made of people, and that is the reason.
Built, hosted and run in the UK
The platform runs in the Azure UK South region, and the guidance, regulation and breach data behind it are the UK ones.
Who it is for
A firm with five staff and a firm with five thousand get the same scam email. Only one of them has somebody whose job it is to spot it.
Cyber security grew up serving big companies, and it still talks that way. Standards are written for people who read standards. Tools are sold per seat to buyers who have a budget line for them. Advice turns up as a forty page PDF that assumes somebody has time to read it.
The attacks moved down to smaller firms years ago. Scam email kits, stolen password lists and ready made ransomware do not check how big you are before they run.
Cyber Made Simple is built for the businesses on the wrong side of that gap. The ones least able to take the hit, and least helped to avoid it.
How it works
The service answers three questions, in the order a business actually asks them.
What would this cost me? Not a score out of a hundred, and not a red square on a dashboard, because you cannot act on either. A range in pounds, built from published UK figures, with the working always one tap away.
What do I do about it? The questions turn that number into a list of gaps in order, and each gap into steps you can finish in the time you have. Most take minutes. The plan still works when a busy month means you do none of them.
How do I show someone? Every finished job leaves proof behind. Customer security questionnaires get drafted from what you have already done. Customers and insurers get a link instead of a promise.
What it costs
There is a level that people and small teams keep for free, permanently, and paid levels that add what a company needs rather than a person.
Which capability sits at which level, and what each one costs, lives on the Cyber Made Simple site rather than here. One place for it means one place for it to be right, and a page that lists prices it does not control is a page that goes stale without anybody noticing.
What Cyber Made Simple is not
- We do not put software on your computers, ask for admin access to your email, or connect to your systems.
- Everything we do is advice, questions you answer yourself, documents we write for you, and checks against information that is already public.
- That limit is on purpose. It means we hold no passwords for your systems and no access to them.
The documents for Cyber Made Simple
- Cyber Made Simple privacy policyWhat Cyber Made Simple collects, why, who it is shared with, how long it is kept, and your rights over it.
- Cyber Made Simple terms of serviceThe terms for using the Cyber Made Simple website, tools and paid plans: accounts, payments, acceptable use, cancellation and liability.
- Cyber Made Simple cookie policyWhich cookies Cyber Made Simple sets, what each is for, how long it lasts, and how to turn them off.