Phishing
Phishing is a trick in which a criminal sends a message pretending to be someone you trust, to get you to click a link, open an attachment or hand over details. Cyber Essentials has no phishing question. Its defences are malware protection, MFA on cloud services (A7.16, A7.17) and separate admin accounts.
- Term
- Phishing
- Also known as
- Phishing email, Spear phishing
- Category
- Malware, cloud and threats
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term phishing mean in Cyber Essentials?
Phishing is a trick in which a criminal sends a message pretending to be someone you trust, to get you to click a link, open an attachment or hand over details.
How does phishing apply to Cyber Essentials?
In plain terms
A phishing email is the digital version of a con artist on the phone. It looks as if it comes from your bank, a supplier or your own finance director, and it asks you to act quickly: pay an invoice to new bank details, sign in through a link, or open an attached file. The link leads to a fake login page, or the file carries malware.
What Cyber Essentials asks
The requirements do not use the word. The Danzell question set mentions it in the introduction to its malware protection section: "Malware is often used in conjunction with other kinds of attack such as ‘phishing’ (obtaining information by confidence trickery)". There is no phishing question and no phishing training requirement.
Several controls still limit the damage when someone does click:
- Malware protection blocks the attachment or the malicious website. A8.3 asks whether your anti-malware software or browser warns about malicious websites.
- MFA on cloud services means a password typed into a fake page is not enough on its own. A7.16 and A7.17 are automatic fails if answered No.
- Separate admin accounts (A7.6, A7.7) keep anything that does run at standard user level.
What an assessor looks for
At Cyber Essentials Plus, sub-test 3.1.1 sends test files to a sampled mailbox from an external account. If a malware test file arrives and the user is not blocked from opening it, the sub-test fails.
See the malware protection requirements and Cyber Essentials Plus test 3. Related: social engineering, multi-factor authentication.
Related terms
- Social engineeringSocial engineering is manipulating people, rather than hacking computers, to get them to hand over information, money or access, usually by pretending to be someone they trust.
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
- RansomwareRansomware is malware that locks or scrambles your files so you cannot open them, then demands payment to unlock them.
- SaaS (Software as a Service)Software as a Service (SaaS) is software you use over the internet through a subscription and a login, such as Microsoft 365 or Gmail, where the provider runs everything behind it.
- SandboxingSandboxing is running a program inside a sealed-off space on a device, so that anything it does cannot reach the rest of the system or your data.
- Security operations centre (SOC)A security operations centre (SOC) is a team, in-house or outsourced, that watches an organisation's systems for signs of attack and responds when something suspicious happens.
Frequently asked questions
Phishing is a trick in which a criminal sends a message pretending to be someone you trust, to get you to click a link, open an attachment or hand over details.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.