An assessment that says everything is medium-risk is no assessment. We rank findings by exploitability, blast radius, and business impact, and we give you the short list of fixes that change your posture in the next 90 days.
What this includes
- Architecture and configuration review across endpoints, network, cloud, identity
- Process review: vulnerability management, patching, access lifecycle, incident handling
- Team capability and operating model review
- Threat-modelling for two to three critical business processes
- External attack surface check
How we run it
Scoping
One week. Identify the assets, the business processes, and the access required.
Fieldwork
Two to three weeks. Interviews, configuration reviews, sample testing, documentation review.
Analysis
One week. Findings ranked, root causes identified, remediation drafted.
Report
Final report, executive summary, and findings workshop with your team.
What you get
- Findings report with prioritised remediation
- Executive summary for management
- Top-10 critical findings on a one-page tracker
- Operating-model recommendations
- Findings workshop session
Why this matters
Assessments fail when the report sits unread because it does not separate critical from cosmetic. The point of an assessment is not to count findings; it is to surface the three to five fixes that materially change your risk posture.
Questions we get
How is this different from a penetration test?
A pen test attacks a defined boundary. An assessment reviews the entire defence model across technology, processes, and team. The two are complementary: pen tests find what slipped past, assessments find what is structurally missing.
How disruptive is the fieldwork?
Minimal. Most of the work is non-intrusive: configuration reviews, interviews, documentation. Where active testing is required, scope and timing are pre-agreed.
Will you re-test after remediation?
Yes. We include a remediation verification step three to six months after the initial assessment, focused on the priority findings. This is the single most underused part of any assessment engagement.
Next step.
A 30-minute scoping call clarifies whether your situation fits this engagement.
Request a briefing