What We Evaluate

External Attack Surface We review what your business exposes to the internet: open ports, remote access services, web-facing systems, and email security configuration. Attackers look for exactly these things and so do we.

User Account Security Compromised credentials are the leading cause of breaches. We evaluate password policies, multi-factor authentication status, privileged account usage, and dormant accounts that should have been disabled long ago.

Endpoint and Network Security We review patch levels across workstations and servers, antivirus and endpoint protection status, firewall configuration, and network segmentation. Each gap is documented with the specific risk it creates.

Data Exposure and Handling We look at where sensitive data lives, who can access it, how it is transmitted, and whether it is protected appropriately. Uncontrolled access to sensitive data is one of the most common and consequential findings in a risk assessment.

Backup and Recovery Posture We verify what is being backed up, how often, where those backups are stored, and whether recovery has been tested. Ransomware is far less devastating when your backups are solid. Most businesses we assess have gaps here they were not aware of.

Vendor and Third-Party Risk Third-party vendors with access to your systems and data represent risk that is often overlooked. We review vendor access levels, software supply chain exposure, and whether your vendor relationships include appropriate security expectations.

What You Get

You receive a written risk report that documents every finding, explains it in plain language, and assigns a risk level so you know what is critical, what is significant, and what can wait. The report is designed to be actionable, not just informational. You should be able to hand it to an IT team or use it to make budget decisions without needing us to interpret it for you.

A risk register documenting every identified vulnerability with context and severity
Prioritized remediation steps for each finding
An executive summary for ownership and non-technical stakeholders
Estimated remediation effort and complexity for planning purposes
Recommendations for ongoing risk monitoring

How It Works

Step 1: Scoping and Access

We define the scope of the assessment and establish the access we need to conduct it. The scope can be limited to a specific area of your business or cover the entire environment. We work within whatever boundaries make sense for your situation.

Step 2: Assessment

We conduct the assessment across every area in scope. We review configurations, test controls, interview staff, and examine your environment from the perspective of both an attacker and an auditor. Findings are documented as we work so nothing gets missed.

Step 3: Risk Report

We compile the findings into a written risk report. Each item is described in plain language, given a risk severity rating, and paired with a clear remediation recommendation. The report is reviewed internally before delivery to make sure every finding is accurate and every recommendation is practical.

Step 4: Findings Review and Next Steps

We walk through the report with you, explain each finding, and answer your questions. We help you understand the actual business impact of each risk and work with you to decide what to address first. If you want us to help remediate what we found, we can scope that work as an immediate next step.

Risk Assessment