Strengthening Trust in Cloud Management: Patronum Achieves Cyber Essentials Plus Certification

Milestone Announcement

We are thrilled to formally announce that Patronum has officially been awarded the prestigious Cyber Essentials Plus certification.

As the leading Google Workspace management and automation platform—trusted by IT departments, educational institutions, and global enterprises to manage user onboarding, user offboarding, Google Drive governance, and organization-wide contact sharing—security is not merely a feature for us; it is the bedrock of our existence.

Achieving Cyber Essentials Plus marks a pivotal milestone in our ongoing commitment to data protection, threat mitigation, and enterprise-grade cloud security. While basic compliance certifications rely solely on self-reported questionnaires, Cyber Essentials Plus demands a rigorous, hands-on, independent technical audit conducted by an accredited third-party assessor. Every endpoint, network interface, cloud configuration, vulnerability management process, and security policy within Patronum was subjected to rigorous live testing.

In an era where supply chain vulnerabilities represent one of the primary vectors for enterprise data breaches, our customers need absolute confidence that the SaaS tools integrated into their Google Workspace domain maintain the highest security standards. Achieving this certification validates that Patronum’s infrastructure and operational environment are hardened against the vast majority of common cyber threats.

Section 1: Understanding Cyber Essentials and Cyber Essentials Plus

1.1 What is Cyber Essentials?

Developed by the UK National Cyber Security Centre (NCSC) and delivered by IASME (Information Assurance for Small and Medium Enterprises), the Cyber Essentials scheme is a government-backed, industry-supported framework designed to help organizations shield themselves against a wide range of the most common cyberattacks.

Cyber threats rarely originate from sophisticated nation-state zero-day exploits aimed at a single target. Instead, the majority of cyber incidents—ranging from ransomware and credential harvesting to automated botnet intrusions—are opportunistic attacks that target well-known, unpatched vulnerabilities and misconfigured systems.

Cyber Essentials defines a robust baseline of technical security controls designed to prevent these common attacks. According to statistics from the UK NCSC, properly implementing the five core Cyber Essentials controls mitigates up to 80% of common internet-borne cyber threats.

1.2 The Two Levels of Certification: Cyber Essentials vs. Cyber Essentials Plus

Understanding the distinction between standard Cyber Essentials and Cyber Essentials Plus is critical for evaluating vendor security posture:

Cyber Essentials (Standard / Stage 1)

• Assessment Method: Self-assessment questionnaire completed by the organization.
• Verification: Reviewed by a qualified assessor to check if responses meet the specified criteria.
• Scope: Assesses stated policies and administrative controls.
• Limitation: Does not independently test whether controls are technically enforced on systems in practice.

Cyber Essentials Plus (Advanced / Stage 2)

• Assessment Method: Independent, hands-on technical audit, credentialed vulnerability scanning, and simulated attack vectors conducted on-site or remotely by a certified cyber auditor.
• Verification: Direct technical evidence obtained through live penetration tools, configuration reviews, and endpoint sampling.
• Scope: Validates that technical controls are actively functioning, configured correctly, and enforced across endpoints, cloud systems, and networks.
• Assurance: Delivers mathematical and empirical proof of technical resistance to common cyber vectors.

Section 2: The Five Technical Control Themes Deep-Dive

To achieve Cyber Essentials Plus, Patronum successfully passed technical evaluations across all five core technical control themes mandated by the NCSC guidelines.

Theme 1: Firewalls and Network Security

Boundaries between internal corporate environments, user devices, cloud services, and the public internet must be strictly controlled to block unauthorized traffic.

• Boundary Firewalls: All incoming network traffic from untrusted sources must pass through dedicated boundary security devices or cloud security groups configured with a default-deny ingress policy.
• Host-Based Firewalls: Every workstation and endpoint operates a local firewall configured to block unsolicited incoming connections.
• Cloud Security Groups: Virtual networks supporting Patronum’s cloud microservices enforce strict subnet isolation, restricting inter-service communication exclusively to required API ports using TLS encryption.
• Administrative Interface Restrictions: Administrative interfaces (such as cloud management portals or SSH/RDP access) are shielded behind Multi-Factor Authenticated (MFA) VPNs or Zero-Trust Network Access (ZTNA) gateways, completely removing public IP accessibility.

Theme 2: Secure Configuration and System Hardening

Default software configurations are optimized by manufacturers for usability rather than security. Unhardened systems often leave open unused ports, unnecessary default accounts, weak cryptographic ciphers, and enabled legacy protocols.

• Removal of Unnecessary Software & Services: Pre-installed bloatware, unused application frameworks, and legacy background services are completely stripped from all server builds and workstation images.
• Account Hardening: Default administrative user accounts (such as admin or root) are renamed or disabled. Default credentials are changed immediately upon provisioning.
• Disabling Unnecessary Ports and Protocols: Legacy management protocols (such as SMBv1, Telnet, or HTTP without TLS) are globally blocked across all networks.
• Auto-Lock Rules: All endpoints enforce a strict 5-minute inactivity session lock, requiring multi-factor or cryptographic authentication to unlock.

Theme 3: User Access Control and Identity Governance

Unauthorized access to systems and sensitive data remains a leading cause of security breaches. Proper access governance ensures that users receive only the minimal level of permissions required to fulfill their job responsibilities.

• Principle of Least Privilege (PoLP): User accounts operate with standard, non-administrative rights. Super-administrative privileges are granted exclusively on a temporary, just-in-time (JIT) basis with mandatory multi-factor authentication (MFA).
• Multi-Factor Authentication (MFA): Enforced across 100% of internal cloud infrastructure, code repositories, email accounts, and administrative portals. Password-only authentication is strictly prohibited.
• Account Deprovisioning: Automated lifecycle hooks instantly revoke user access across all systems and cloud providers upon employee offboarding.
• Password Policy & Credential Vaulting: Minimum length mandates, breach-list checking (preventing passwords exposed in known dark web leaks), and mandatory enterprise password manager adoption across all staff.

Theme 4: Malware Protection

Malicious code can infect systems through malicious email attachments, web downloads, compromised USB drives, or unpatched application vulnerabilities. Cyber Essentials Plus requires verified protection against execution of malicious payloads.

• Centralized Endpoint Protection (EDR): All company endpoints deploy enterprise-grade Endpoint Detection and Response (EDR) agents capable of real-time behavioral analysis, memory protection, and instant network isolation upon anomaly detection.
• Application Whitelisting / Sandboxing: Operating system controls restrict execution to cryptographically signed software binaries from trusted software vendors.
• Web & Browser Protections: Web traffic is filtered to block access to known malicious domains, phishing sites, and risky file types (.exe, .scr, .vbs, etc.).

Theme 5: Security Update Management (Patching)

Vulnerabilities in operating systems, web browsers, enterprise apps, and cloud dependencies are discovered constantly. Threat actors automate tools to exploit these vulnerabilities within hours of public disclosure.

• The 14-Day Patching SLA: Cyber Essentials Plus mandates that all “High” and “Critical” severity vulnerabilities (defined by a Common Vulnerability Scoring System [CVSS] score of 7.0 or higher) MUST be patched within 14 days of release by the vendor.
• Automated Patch Management: Operating systems, browsers, and core utility software utilize automated deployment pipelines to enforce security patches without requiring manual user intervention.
• Third-Party Dependency Scanning: Application code dependencies (such as Node.js, Python, or Go packages) undergo automated daily vulnerability scanning within continuous integration/continuous deployment (CI/CD) pipelines to ensure vulnerable libraries never reach production.

Section 3: The Audit Process: How Patronum Achieved Cyber Essentials Plus

Achieving Cyber Essentials Plus required a comprehensive effort spanning internal system audits, technical hardening, and intensive third-party testing.

Phase 1: Self-Assessment Questionnaire (Stage 1)

Patronum completed the comprehensive IASME self-assessment covering all technical control areas. Every response required verified documentation, operational policy artifacts, network architecture diagrams, and hardware/software inventories.

Phase 2: Scope Definition & Endpoint Sampling

An accredited, independent cyber security auditor defined the technical boundary of the assessment. The scope encompassed:

• All cloud environments hosted in cloud data centers supporting Patronum’s microservices.
• All corporate endpoints utilized by Patronum staff (macOS, Windows, and ChromeOS devices).
• Cloud SaaS management portals, identity providers (IdPs), and source code control infrastructure.

The auditor selected a representative sample of user workstations across various departments (Engineering, Customer Support, Operations) for hands-on credentialed auditing.

Phase 3: External Infrastructure & Penetration Scanning

The auditor conducted extensive external vulnerability scans against all public IP addresses, domain names, and cloud edge locations associated with Patronum.

• Port Scanning: Probing all 65,535 TCP/UDP ports to ensure no unauthorized management ports or debug services were publicly exposed.
• Vulnerability Enumeration: Scanning web application firewalls and APIs for known framework vulnerabilities, TLS configuration flaws, or weak cipher suites.
• Result: Zero open unauthenticated access vectors or unpatched critical vulnerabilities detected.

Phase 4: Credentialed Internal Endpoint Auditing

The auditor gained credentialed access to the sampled user workstations to perform deep-dive technical checks:

1. Patch Verification: Running diagnostic scripts to verify that OS build numbers, web browser versions (Chrome, Firefox, Safari), and system utility versions strictly complied with the 14-day update rule for CVSS 7.0+ vulnerabilities.
2. Local Security Configuration Audit: Verifying host firewall rules, disk encryption status (FileVault/BitLocker), and verifying that local user accounts lacked local administrator privileges.
3. EDR Agent Status Check: Ensuring endpoint detection agents were active, updated, and tamper-resistant.

Phase 5: Simulated Cyber Attack Vectors

To test malware defenses in real-world scenarios, the auditor attempted to execute controlled exploit payloads on test systems:

• Email Delivery Test: Sending structured emails containing test malware payloads (such as EICAR test files and executable attachments obfuscated using common malware packaging techniques) directly to internal company mailboxes.
  • Result: Email security filters successfully flagged, quarantined, or stripped 100% of malicious attachments prior to user inbox delivery.
• Web Download & Direct Execution Test: Navigating to auditor-controlled web domains attempting to download executable files, malicious scripts, and weaponized office documents.
  • Result: The browser, EDR agent, and operating system execution prevention policies blocked or prevented execution of every malicious test file.

Phase 6: Final Evaluation and Certification

Following the successful completion of technical audits, the independent certification body reviewed all diagnostic logs, vulnerability scan reports, and audit artifacts. Finding zero compliance gaps or unmitigated high-risk vulnerabilities, the body officially issued Patronum’s Cyber Essentials Plus Certification.

Section 4: Why Cybersecurity Matters to Patronum Customers

Patronum serves as an essential automation engine for Google Workspace environments across the world. When enterprise customers deploy Patronum, they grant our platform authorized API permissions to manage user lifecycles, file permissions, signature policies, and organizational units.

Because Patronum operates within the sensitive core of your Google Workspace ecosystem, our security controls directly affect your domain’s security posture.

1. Eliminating Third-Party and Supply Chain Risk

Modern cyber incidents frequently exploit third-party vendor relationships rather than targeting primary enterprise networks directly. If a third-party SaaS tool suffers a breach, threat actors can abuse its API tokens to compromise connected enterprise cloud environments.

By achieving Cyber Essentials Plus, Patronum demonstrates that our own operational networks, administrative workstations, and service environments are secured against breach attempts. This protects our customers from supply chain compromise.

2. Safeguarding Google Workspace Domain Integrity

Patronum interacts with critical Google Workspace APIs, including:

• Directory API: User provisioning, suspension, group membership management, and organizational unit placement.
• Drive API: File permission modification, shared drive management, and external sharing exposure audits.
• Gmail / Contacts API: Signature enforcement, organizational contact sharing, and delegation configuration.

Because Patronum processes requests affecting user access and data visibility, maintaining strict internal security controls ensures that no unauthorized third party can tamper with Patronum’s processing logic or misuse elevated Google Workspace API privileges.

3. Supporting Regulatory Compliance (GDPR, HIPAA, ISO 27001, SOC 2)

Organizations operating under strict data protection frameworks (such as the UK/EU General Data Protection Regulation, HIPAA in healthcare, or PCI-DSS in finance) face regulatory requirements to ensure all sub-processors demonstrate verifiable technical security controls.

Section 5: The Technology Behind Patronum’s Secure Architecture

Achieving Cyber Essentials Plus complements Patronum’s core security-by-design architecture. Here is a technical overview of how we safeguard user data:

1. Zero-Storage Architecture for Sensitive File Contents

Patronum is an orchestration and management layer—we do not store your company’s files or private emails on our servers.

• When Patronum manages Google Drive file permissions, it processes metadata (file IDs, owner email addresses, permission lists) in transit.
• Your proprietary document contents remain securely stored within Google’s encrypted infrastructure at all times.

2. Fine-Grained OAuth 2.0 Scopes and Least Privilege

Patronum utilizes Google’s official OAuth 2.0 authentication protocols.

• Customers explicitly grant granular API scopes required for specific functionality.
• Service account credentials and authentication tokens are encrypted using AES-256 at rest and stored within secure key management systems with restricted access control policies.
• Customers retain full control to revoke Patronum’s access at any time directly through their Google Workspace Admin Console.

3. Encryption Standard Enforcement

• Data in Transit: All web traffic between user web browsers, Patronum cloud services, and Google Workspace APIs is enforced via TLS 1.3 using modern cryptographic cipher suites. Legacy TLS protocols (1.0 and 1.1) are permanently disabled.
• Data at Rest: All system databases, configuration stores, and operational audit logs are encrypted at rest using AES-256 encryption.

4. Continuous Automated Vulnerability Scanning

In addition to annual Cyber Essentials Plus audits, Patronum utilizes automated code analysis tools integrated into our software build pipelines:

• Static Application Security Testing (SAST): Scans source code for potential vulnerability patterns (SQL injection, XSS, insecure deserialization) prior to code merge.
• Dynamic Application Security Testing (DAST): Performs automated vulnerability testing against running staging environments.
• Software Composition Analysis (SCA): Scans open-source libraries for public vulnerabilities (CVEs) on a continuous basis.

Section 6: Actionable Advice for Google Workspace Admins

While Patronum works to secure our platform, enterprise cloud security is a shared responsibility. We encourage all IT administrators to implement the following five essential security best practices within their own Google Workspace domains:

The extensive testing process included:

• Infrastructure Vulnerability Scanning: Automated scanning of Patronum’s servers and endpoints to detect known vulnerabilities.
• Patch Verification: Rigorous auditing of OS and application patch levels to ensure compliance with mandatory timeframes.
• Endpoint Configuration Audits: Deep-dive checks on host firewall rules, user permissions, and other local security configurations.
• Direct Exploitation Testing: Simulated attacks to check for practical resistance against malware payloads delivered via email and the web.

Section 4: Why Cybersecurity Matters to Patronum Customers

Patronum serves as an essential automation engine for Google Workspace environments. When enterprise customers deploy Patronum, they grant our platform authorized API permissions to manage user lifecycles, file permissions, and organizational units. Because Patronum operates within the sensitive core of your Google Workspace ecosystem, our security controls directly affect your domain’s security posture.

1. Eliminating Third-Party and Supply Chain Risk

By achieving Cyber Essentials Plus, Patronum demonstrates that our operational networks, administrative workstations, and service environments are secured against common breach attempts. This helps protect our customers from supply chain compromise.

2. Safeguarding Google Workspace Domain Integrity

Patronum interacts with critical Google Workspace APIs, including the Directory API and the Drive API. Because Patronum processes requests affecting user access and data visibility, maintaining strict internal security controls ensures that Patronum’s API access is secure.

Conclusion: Security as an Unending Journey

Achieving Cyber Essentials Plus is a proud milestone for Patronum, but we view security as an evolving process rather than a static destination.

As cyber threats become more sophisticated and cloud environments increase in complexity, our commitment to safeguarding customer data remains absolute. We will continue investing heavily in our security infrastructure and refining our operational controls to ensure Patronum remains the safest, most reliable Google Workspace automation platform on the market.

We extend our sincere thanks to our customer community, partners, and engineering teams whose dedication made this achievement possible.

Verification Search “Bespin Labs Limited” on the official IASME Cyber Essentials database to verify our current certification status.