RISK ASSESSMENTS
Find out where you actually stand.
We assess your organization the way an attacker would look at it — your systems, your people, your vendors, and your physical space — then tell you in plain language what we found, what it would cost you, and what to fix first. You get a report you can act on and hand to anyone who asks.
Most assessments are written for someone other than you.
A typical report runs eighty pages, opens with a methodology section, and lists two hundred findings in severity order with no sense of which ones matter to your business. It's technically accurate and practically useless. Nobody at your organization has the time or the background to turn it into a plan, so it gets filed.
There's a narrower version of the problem too. Most assessments only look at the network. But the way small organizations actually get hurt rarely respects that boundary — a contractor with a door code and a laptop, a former employee whose access was never removed, a vendor with a standing connection into your systems. Assess only the network and you've measured a fraction of your exposure.
WHAT WE ASSESS
What we look at.
External exposure
What's visible from the internet: exposed services, domain and email security, leaked credentials, dark web presence.
Internal systems
Configuration, patching, access controls, backups, and whether they've ever been tested.
Identity and access
Who has access to what, who shouldn't, and what happens when someone leaves.
People
How your team would actually respond to the attacks aimed at them.
Vendors
Third parties with access to your systems or data, and what your agreements with them actually say.
Physical
Doors, cameras, visitor handling, and where the two worlds meet: server rooms, unattended workstations, and printed material.
HOW IT WORKS
How an assessment runs.
- 1
Scope it
A short conversation about your environment and what you're accountable to. No lengthy questionnaire to fill out first.
- 2
Assess
Technical testing, document review, interviews, and where relevant, a walkthrough of your space.
- 3
Prioritize
Findings ranked by what they'd actually cost you, not by generic severity score.
- 4
Deliver
A report written for decision-makers, with a technical appendix for whoever needs it.
- 5
Walk you through it
We present the findings and answer questions. You should never receive a report you don't understand.
WHO IT’S FOR
Built for organizations under 250 people.
- A cyber insurance application or renewal asking questions you can't confidently answer
- A client, prime contractor, or board asking what your security posture is
- A HIPAA Security Rule risk analysis that's required and overdue
- A new leader, new system, or acquisition, and nobody's looked in years
- A quiet suspicion that things aren't as covered as you've been told
A starting point, not a commitment.
An assessment is a defined engagement with a fixed scope and a deliverable at the end. Plenty of organizations use it to decide whether they need us at all — and some walk away knowing they're in better shape than they thought. That's a fine outcome. If you do want the findings handled, our monthly program is where that happens.
See what the monthly program coversAn assessment tells you what to fix. Managed cybersecurity and 24/7 monitoring is how the fixes stay in place, and compliance and fractional CISO work turns the findings into the documented program an auditor, insurer, or prime contractor expects.