Bulletproof review: Cyber Essentials in 2026

Bulletproof Cyber is now part of WorkNest Secure, which brings Bulletproof and Pentest People together within WorkNest Group. Its wider security services may suit organisations buying certification alongside penetration testing or managed security. Fig Group publishes a Micro-tier price and a conditional Cyber Essentials turnaround guarantee for buyers who want a defined certification route. Check each supplier's current licence, package and terms before choosing.

• Part of: WorkNest Secure within WorkNest Group; the Bulletproof name remains in use
• IASME-licensed: yes - verifiable on the IASME directory
• HQ: Stevenage, Hertfordshire
• Scope of services: Cyber Essentials, CE Plus, CREST penetration testing, managed SIEM, vCISO, ISO 27001 support
• Typical customer profile: mid-market organisations buying a suite of services, not just certification

Bulletproof's scale and breadth of services is real - if you need a pentest alongside the certification, a single supplier can be convenient.

We could not verify a current like-for-like Bulletproof Cyber Essentials package price or guaranteed turnaround from its public offer. Ask WorkNest Secure for a written quote stating the organisation-size tier, what support is included, the review clock and any Plus or penetration-testing scope. A general consultancy price range is not a Bulletproof quote.

• You need penetration testing and CE/CE Plus bundled. Their CREST-accredited pen test team can run CE Plus vulnerability testing in-house.
• You are also buying managed services. SOC, SIEM, vCISO bundling can justify the higher price point.
• You want to source several security services together. Check the specific WorkNest Secure contracting entity and package before relying on a group relationship in procurement.

1. Published price at £299.99 + VAT for the Micro tier. Fig Group's pricing is on our pricing page and held without a sales conversation.

2. 6-working-hour certification SLA on clean Micro-tier submissions - designed for organisations with a tender deadline this week, not next month.

3. Platform-first delivery. Fig Group's delivery model is self-serve online with assessor review, not consultancy hours.

4. Verifiable licence. Check the current certification-body record for Fig Compliance Ltd on the IASME directory.

As with every IASME-licensed body, the certificate Bulletproof issues and the one Fig Group issues is the same IASME-validated certificate. Twelve-month validity, listed on the same directory, accepted by the same buyers and insurers. The commercial model differs; the certification does not.

• Your renewal is coming up and you want to separate certification from the consultancy bundle
• You want a fixed, low, published price with no negotiation
• You have a supplier-onboarding deadline and need a documented assessment clock after a complete, compliant submission

Before paying any certification body:

1. IASME licence verified on the IASME directory

2. Price in writing with VAT shown

3. Assessor SLA - submission-to-review time

4. Resubmission policy if the first review fails

5. Scope in writing - what staff count, what devices, what geographies

Bulletproof is a credible, IASME-licensed body and a reasonable choice for organisations buying certification as part of a wider security bundle. If you just want the certificate at the lowest verifiable price with the fastest turnaround, Fig Group's £299.99 + VAT Micro tier and 6-hour SLA is a straightforward alternative. Either way, the IASME-arranged £25k cyber liability cover ships with any valid CE certificate where the eligibility criteria are met.

Start Cyber Essentials with Fig Group - from £299.99 + VAT | All pricing tiers | Bulletproof comparison