AI-powered Cyber Essentials readiness assessment for UK small and medium businesses. Understand your gaps, get a score, unlock a practical remediation report.
Cyber Essentials matters, but preparing for it doesn't have to take weeks or cost thousands of pounds in consultancy fees. I kept seeing UK small businesses stall out on it, not because the technical controls are hard, but because the preparation process is opaque and the language is written for auditors, not business owners. My background is in cybersecurity research (MSc Cyber Security with Advanced Research, University of Hertfordshire), and I wanted to bring that same rigour to a process most SMEs experience as a confusing checklist with no explanation.
BrightCert guides a UK SME through a plain-English readiness assessment covering all five Cyber Essentials control areas: Boundary Firewalls & Internet Gateways, Secure Configuration, User Access Control, Malware Protection, and Security Update Management. It takes about two hours. Gemini then analyses the responses and returns a readiness score, a plain-English breakdown per control area, and a prioritised list of what to fix first. The full report, including gap analysis and remediation steps, unlocks as a downloadable PDF for £199, versus £2,000-5,000 for a traditional consultant. BrightCert doesn't issue the official Cyber Essentials certificate itself; that comes from an IASME-licensed Certification Body once you're ready to apply.
Next.js 16 (App Router, TypeScript) on Vercel, with Supabase for Postgres and auth (magic link plus Google OAuth). Gemini 2.5 Flash is the core analysis engine: it takes the structured questionnaire responses and returns per-control scores, gap findings, and remediation steps as strict JSON. Generated PDF reports are built server-side and stored in Google Cloud Storage behind signed URLs. Stripe Checkout handles the one-time £199 payment, and Resend sends the transactional emails. Styling is Tailwind CSS with a customised shadcn/ui component set.
Gemini's gemini-2.0-flash was deprecated partway through the build, which meant migrating to gemini-2.5-flash and switching to a billing-enabled API key after the original free-tier key silently hit a zero quota. Supabase magic-link auth also looped in production under the default PKCE flow, since it depends on the exact code-verifier cookie matching the clicked link; that got fixed by moving to the token_hash and verifyOtp flow, which survives multiple link requests and cross-device clicks. On the PDF side, the remote Google Fonts woff URLs I was using for the Inter typeface started 404ing inside the PDF renderer, so I stopped fetching them at render time and bundled the font files into the repo, registering them from disk instead.
The whole path runs on a live, real domain: signup, the 60-question assessment, Gemini analysis, Stripe Checkout, PDF generation, and delivery through a signed Google Cloud Storage URL. Gemini analysis and Cloud Storage delivery are both verified in production against the deployed build; the checkout path is deployed and exercised in Stripe test mode, with no live customer purchase completed yet. Real UK businesses have already started assessments on the live site before this submission was even finished.
Structured, rubric-based analysis is exactly what Gemini is good at: giving it a fixed scoring framework (five control areas, clear pass/warning/fail thresholds) rather than open-ended judgement produced far more consistent, useful output than a looser prompt did early on. I also learned how much of "compliance UX" is really translation work, most of Cyber Essentials' actual technical bar is achievable for a small business, the hard part is nobody explains it to them in language they use day to day.
Beyond initial readiness prep: a Monitor subscription for ongoing readiness tracking between assessments, a CE Plus preparation pack for businesses moving on to the technical verification stage, and multi-client tooling for MSPs and IT providers supporting several SME clients through Cyber Essentials at once.
Log in or sign up for Devpost to join the conversation.