Commodity attacks
Commodity attacks are cheap, widely available attacks, run with off-the-shelf tools against many organisations at once, looking for anyone with an easy weakness rather than targeting you specifically. Cyber Essentials is built to stop them. The Plus test specification describes the threat as an 'Internet-based opportunist attacker' using 'typical low-skill methods'.
- Term
- Commodity attacks
- Also known as
- Commodity threats, Opportunistic attacks
- Category
- Malware, cloud and threats
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term commodity attacks mean in Cyber Essentials?
Commodity attacks are cheap, widely available attacks, run with off-the-shelf tools against many organisations at once, looking for anyone with an easy weakness rather than targeting you specifically.
How does commodity attacks apply to Cyber Essentials?
In plain terms
Think of a thief walking down a street trying every car door. They are not after your car in particular. They want whichever one is unlocked. Commodity attacks work the same way online: automated tools sweep the internet for default passwords, unpatched software and exposed login pages, and phishing emails go out in bulk. Anyone with an easy weakness becomes a victim.
What Cyber Essentials asks
Neither the requirements v3.3 nor the Cyber Essentials Plus test specification v3.2 uses the word "commodity". They describe the same threat in their own words:
- The secure configuration section says that "by applying some simple technical controls when installing computers and network devices, you can minimise vulnerabilities and protect against common types of attack."
- The wireless devices section keeps the scheme focused on internet-based attacks: "the Cyber Essentials scheme isn’t concerned with attacks that can only be launched within the signal range of the wireless device".
- Test case 1 of Cyber Essentials Plus exists "To test whether an Internet-based opportunist attacker can hack into the Applicant's system with typical low-skill methods."
- Test case 2 looks for missing fixes "that could be exploited within the bounds of the CE threat model".
Worth knowing
Cyber Essentials is a baseline against this kind of opportunist. It is not designed to stop a skilled attacker who has chosen you as a target. If your customers or your risks need more, the next steps include a penetration test or monitoring from a security operations centre.
See what is Cyber Essentials? and Cyber Essentials Plus. Related: attack surface, phishing.
Related terms
- Penetration testA penetration test is an authorised, simulated attack in which skilled testers try to break into your systems the way a real attacker would.
- Security operations centre (SOC)A security operations centre (SOC) is a team, in-house or outsourced, that watches an organisation's systems for signs of attack and responds when something suspicious happens.
- Attack surfaceAn attack surface is every point where an attacker could try to get into your organisation: each internet-facing service, device, account and piece of software.
- PhishingPhishing is a trick in which a criminal sends a message pretending to be someone you trust, to get you to click a link, open an attachment or hand over details.
- EDR (endpoint detection and response)Endpoint detection and response (EDR) is security software on each computer that records activity, spots suspicious behaviour and helps someone stop an attack.
- EncryptionEncryption is scrambling information with a secret key so that only someone holding the right key can read it.
Frequently asked questions
Commodity attacks are cheap, widely available attacks, run with off-the-shelf tools against many organisations at once, looking for anyone with an easy weakness rather than targeting you specifically.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.