A cyber security assessment that tells you what to fix first.
Most assessment reports we're handed by new clients run to 80 pages and nobody has read past the summary. Ours is shorter, ranked by impact, and written so a managing director can act on it.
You know something isn't right, but not where to start.
The usual trigger is a near miss — a mailbox compromise, a payment diverted, a laptop left on a train — or a customer asking for evidence you don't have. The temptation is to buy a product. The better move is to spend a few days finding out where the real gaps are.
Interviews, configuration review and light-touch testing.
We spend time with whoever runs IT, review Microsoft 365, endpoints, firewall and backup configuration directly rather than relying on a questionnaire, and run an external vulnerability scan. Where it's useful we'll do a short phishing exercise.
Findings are scored against likelihood and business impact, then mapped to Cyber Essentials so you can see how far you are from certification.
Everything in the engagement, set out up front.
Identity and Microsoft 365 review
MFA coverage, admin roles, conditional access, mailbox forwarding rules, legacy authentication.
Endpoint and patching review
Device inventory, EDR coverage, patch currency including third-party apps like browsers and PDF readers.
Backup and recovery check
What's backed up, where, how it's protected from ransomware, and when it was last restored.
What you receive.
- Director-level summary (two pages)
- Ranked findings with fixes and effort
- Cyber Essentials gap view
- A 90-day remediation plan
Built for organisations that need the work done properly.
Businesses with no recent independent review
If nobody outside your IT provider has looked in the last two years, this is the place to start.
Firms facing a supplier audit
We'll align the assessment to the questionnaire so the work does double duty.
What changes once the work is done.
A shortlist, not a long list
The five or six things that would make the most difference, in order.
Costs you can budget
Each fix has an effort estimate so you can plan it in.
A baseline to measure against
Re-run it in a year and see what's actually improved.
Questions we are asked most often.
How long does an assessment take?
For a 20–100 person firm, typically three to five days of consultant time spread over two weeks, with the report a week later.
Will it disrupt staff?
No. Most of the work is configuration review and conversations with whoever looks after IT. The external scan is non-intrusive.
Is this the same as a penetration test?
No. A pen test goes deep on a defined target. An assessment goes broad across the whole business. Many clients do the assessment first and pen test what it highlights.
What happens after the report?
You can fix things yourselves, ask your IT provider, or have us do it. There's no obligation to buy anything else.
Book a cyber security assessment.
A 30-minute call with a consultant, not a salesperson. We'll ask about your setup, tell you honestly whether we can help, and what it would roughly cost.
Book a conversation