Security Assessment
A quick self-assessment
8 short sections, about 3 minutes. This gives a high-level, self-reported indication, not a formal audit.
What this assessment covers
Each section asks a small number of direct questions and scores your answers against a simple four-point scale (Needs attention, Developing, Moderate or Strong), so you get an indicative maturity read across eight areas that most commonly determine whether an incident turns into a minor disruption or a serious one:
Identity & Access
How access is granted, reviewed and revoked: MFA coverage, privileged account hygiene, and whether joiner-mover-leaver processes actually get followed.
Endpoint
Whether laptops, servers and mobile devices are managed, patched and monitored consistently, or left to drift once they leave a standard build.
Cloud & Microsoft 365
Configuration of the cloud platforms and Microsoft 365 tenants you already run: the gap between what you're licensed for and what's actually enforced.
Application Security
How security is built into the software you ship or rely on: code review, dependency management, and whether testing happens before or after release.
Detection & Response
Whether you'd actually notice an incident in progress, and what happens in the first hour after you do.
Resilience
Backup integrity, recovery testing, and whether a ransomware event would be a bad week or an existential one.
Governance & Third Parties
Policy, risk ownership, and how much visibility you have into the security posture of vendors and partners with access to your systems.
AI Use
Where AI tools and LLM-powered features have been adopted, and whether the new risks that come with them (prompt injection, data leakage, excessive agency) have been considered at all.
Your answers stay in your browser for this session. Nothing is sent anywhere unless you choose to follow up with us afterwards.
Section 1 of 8