Straight answers about cyber health checks and secure websites.

We agree the scope in writing, then work through the areas you have approved: email and account access, multi-factor sign-in, devices and updates, backups and whether recovery has been tested, your website and its forms, and how customer information is handled. You get a plain-language summary of what is working, what needs attention, and a sensible order to tackle it in. Nothing is tested without your written permission.

Most small businesses need one short conversation to agree the scope, then a review that runs in the background, then a walk-through of the findings. Your time is mostly in the first and last of those. The exact length depends on how many systems and people are involved, which is agreed before anything starts.

Work is quoted per business rather than sold from a price list, because a sole trader with one laptop and a 30-person firm with a web application are not the same job. You get a written quote covering scope, deliverables and exclusions before any work begins, and there is no charge for the initial conversation.

No. A Cyber Health Check is a review, not an attack. We look at configuration, settings and process, and we only ever look at what you have authorised in writing. Full penetration testing is a separate, specialist engagement and is not part of this service.

No. Certification has to come from a licensed certification body, and GSKordeven is not one. What we can do is help you understand where you currently stand against the kind of controls Cyber Essentials asks about, so that if you do go for certification later you are not starting cold. We will never describe you as certified when you are not.

Either. Some clients take the action plan to their existing IT provider, some ask us to carry out the improvements, and some do the easy items themselves and hand over the rest. The report is written so it is useful whichever route you choose.

No, and it is not meant to. Day-to-day IT support and an independent look at cyber risk are different jobs, and it is often healthier when they are not the same person. The findings are written so your existing provider can act on them directly.

Most attacks are not aimed at anyone in particular. They look for whatever is easiest to get into: a reused password, a missing second sign-in check, software that stopped being updated, an old administrator account nobody closed. Being small does not keep you off that list, and the UK government's own breach survey finds incidents across every business size.

GSKordeven is based in Scotland and works with businesses across the United Kingdom. Reviews, websites and applications are all delivered remotely, so location rarely affects the work.

It is used to do the work you have asked for and nothing else. Enquiries are kept in a restricted area of the website and in the business mailbox, are never published, and are reviewed for deletion once they are no longer needed. The Privacy Policy sets out the detail, including retention periods and your rights.

No, and please do not send them through the enquiry form. If a piece of work genuinely needs access later, an appropriate method and a clear scope are agreed first. The form deliberately refuses anything that looks like a password, key, token or card number.

No website or application can ever be guaranteed completely secure, and anyone who promises that is overselling. What can be done is to remove avoidable weaknesses, limit access, protect the information you hold, keep software supported and make sure recovery is possible when something does go wrong.