60 breaches in six weeks: what South Korea's AI hacking case means for you
Police say one attacker used AI tools to breach 60 organisations in six weeks. What really happened, and what UK businesses should do about it.
Zarco
ai, compliance and pentesting for uk businesses
Harder to attack. Easier to run.
A UK consultancy for AI and cyber security. One team to put AI to work, get you certified, and find the ways in before anyone else does.
01What we do
One team for the systems you run and the ones you protect
The systems you put AI on are the same ones an attacker goes after. So we do both: put AI to work, prove the essentials are in place, and test for the ways in that no checklist covers.
Common questionsAI servicesAssistants that take on the busywork
ComplianceCyber Essentials, CE+ and DCC
PentestingEvery way in, found and confirmed
You getOne accountable team
5technical controls every Cyber Essentials certificate checks
14 daysto apply high-risk and critical security updates
12 monthshow long Cyber Essentials and CE+ certificates last
3 yearsthe life of a DCC certificate, with yearly checks
02Why one team
AI reads your inbox, your files and your customer records
That's why we do security too. Many of the firms that call us about AI are also being asked for Cyber Essentials by a customer, an insurer or a tender. Doing both with one team means the systems we connect AI to are ones we've already checked.
Internet-facingForgotten systems, missed updates
Web apps and APIsWho can see whose data
Cloud and identityPermissions, MFA and secrets
AI toolsOnly the access they need
03How it works
How working with us starts
The same four steps, whichever service you need. Scope, price and timings are agreed in writing before any work starts.
Call
Thirty minutes. Tell us what you need and why: a tender deadline, an insurer's form, a system to test, or a job you'd like AI to take on.
Plan
Scope, timings and a fixed price, agreed in writing before any work starts.
Work
A readiness check and fixes before assessment, a scheduled test window, or a first AI workflow live within weeks.
Keep current
Renewal reminders, retests and model upgrades, so nothing quietly lapses.
04Which certificate
Which certificate do you need?
It usually depends on who's asking. Here's how the four compare.
Compliance| Certificate | How it's checked | Usually asked for by | Valid for |
|---|---|---|---|
| Cyber Essentials | Self-assessment questionnaire, reviewed by an independent assessor | Public sector contracts, larger customers, cyber insurers | 12 months |
| Cyber Essentials Plus | The same questionnaire, plus a hands-on technical audit of your devices and an external scan | Contracts involving sensitive data, and customers who want proof the controls work | 12 months |
| DCC Level 0 | A current Cyber Essentials certificate, plus a short supplier assurance questionnaire | Ministry of Defence contracts rated very low risk | 3 years, checked yearly |
| DCC Level 1 | A current Cyber Essentials certificate, plus an assessment against the defence standard's wider set of controls | Most standard MOD contracts with some access to MOD data or systems | 3 years, checked yearly |
The MOD or your prime contractor sets the DCC level for each contract. Not sure which applies? Send us the tender wording and we'll tell you.
05Research and guides
Read these first
Plain-English guides to the questions we hear on every call.
All articlesWhat you’re really paying for in a penetration test
Much of a traditional penetration test isn’t testing: it’s scanning, waiting and writing reports. Why that happens, what “penetration test” should mean, and seven questions to ask before you buy one.
Tom Reynolds
What a penetration test report should include
The sections that make a report useful, and the warning signs of one that isn't.
Tom Reynolds
06Questions
Questions we hear before we start
What's the difference between Cyber Essentials and Cyber Essentials Plus?
Both check the same five controls: firewalls, secure configuration, security updates, user access and malware protection. Cyber Essentials is a self-assessment that an independent assessor reviews. Cyber Essentials Plus adds a hands-on technical audit, where an assessor tests your devices and scans your systems from outside to confirm the controls actually work. You need Cyber Essentials before you can go for Plus.
How long does certification take?
It depends on where you're starting. If your setup is already in good shape, Cyber Essentials can be done in a matter of days. If there are gaps, we'll tell you exactly what would fail and help you fix it before anything is submitted, so you're not paying for a failed assessment.
Do we need Defence Cyber Certification?
If you supply the Ministry of Defence, directly or through a prime contractor, probably yes. The MOD has asked its suppliers to hold at least DCC Level 0, and many standard contracts call for Level 1. Both need a current Cyber Essentials certificate first, and we provide both levels.
Who carries out the penetration testing?
We do. Zarco runs every test in-house: AI agents handle the volume of the work, and an experienced tester confirms every finding before it goes in the report. You deal with the same team from the first call to the retest.
Is it safe to use AI with our company data?
It can be, if it's set up properly. We use business plans that don't train on your data, give each tool only the access it needs, and keep a person approving anything that leaves the building. For data that can't leave your premises at all, we can run models on your own hardware.
What does it cost?
Everything is quoted up front after the first call. Certification and testing are fixed-price. AI work is scoped in stages, so you only ever commit to the next step.
Talk to us about AI, compliance or testing.
A 30-minute call, a straight answer, and a fixed quote if there's work to do.
→Contact
Tell us what you need.
A tender deadline, an insurer's questionnaire, a system you want tested, or a job you'd like AI to take off your team's hands. We reply within one working day, UK hours.
- A 30-minute first call, with no obligation
- A fixed quote before any work starts
- A UK-based team you can talk to directly