Cyber Essentials v3.3, three months on: what's actually catching businesses out

The April 2026 "Danzell" update to Cyber Essentials has now been in force for several months. Enough time has passed that it's worth revisiting, not as an announcement this time, but as a look at what's actually catching businesses out now that the initial wave of "what's changed" explainers has settled.

This isn't drawn from formal statistics, we don't run the certification assessments ourselves, but the pattern is consistent enough to be worth naming. It keeps landing on the same three areas, which happen to be the same three the rest of this site keeps coming back to for a reason: they're where the gap between "we thought we were compliant" and "we actually are" tends to hide.

It keeps landing on the same three areas, where the gap between "we thought we were compliant" and "we actually are" tends to hide.

First, MFA scope on free and personal-tier cloud tools. Businesses that locked down their core systems years ago are still getting caught by the Trello board, the free Slack workspace, or the Canva account someone signed up for without IT ever formally approving it. Second, the 14-day critical patch rule, which keeps tripping up businesses that do patch, just not fast enough for the most severe updates. Third, scoping for remote and multi-entity setups, where a home-working arrangement that felt settled a year ago turns out not to match how the current rules actually draw the boundary.

None of this means the rules themselves are unreasonable. It means that a pass under an older question set, or an assumption that hasn't been checked since last year's certification, isn't something to take on faith. The businesses getting caught out aren't careless, they're working from an understanding of "compliant" that's quietly gone out of date.

If it's been a while since you looked at where you actually stand against the current rules, run the free 5-minute readiness check to see whether any of these three apply to you, or book a free 30-minute call if you'd rather talk it through.