How exposed is your business, really?
Eight plain-English questions. No email required to see your score. You’ll get an instant read on where your IT and cybersecurity posture is solid — and where the gaps are that owners usually don’t find out about until something breaks.
Your tailored action list.
Ordered by what we’d fix first. Each links to a plain-talk guide if you want the detail.
Want this as a one-page action plan in your inbox?
We’ll email your score, a prioritized fix list ordered by what to tackle first, and the matching plain-talk guide for each gap — a one-pager you can hand to whoever runs your IT. One email with your results, no drip sequence; the monthly brief below is separate and only if you tick the box.
Prefer to just talk it through? That’s usually faster.
If you’d rather skip ahead, the 20-minute intro call is the fastest way to turn this list into a plan.
This self-assessment is an educational tool, not a formal security audit or a guarantee of compliance. Your answers are scored entirely in your browser and are never sent anywhere unless you enter your email above. For a real evaluation of your environment, book a discovery call.
What this IT risk assessment checks.
The assessment walks through the eight areas where small and mid-sized businesses most often carry hidden risk — the same areas a cyber-insurance carrier, an auditor, or an incident responder asks about first:
- Backups and recovery — whether backups exist, are isolated, and have actually been restore-tested.
- Multi-factor authentication — whether MFA is enforced on email, remote access, and every account that matters.
- Endpoint protection — modern EDR with monitoring versus legacy antivirus.
- Patching — whether operating systems and third-party apps are centrally updated, with proof of coverage.
- Phishing and people — training and the email controls that blunt business email compromise.
- Disaster recovery — whether there’s a tested plan, not just a document on a shelf.
- IT ownership — proactive managed support versus reactive break-fix.
- Regulated data — documented controls for HIPAA, PCI, CJIS, or other obligations you carry.
Why a risk assessment is worth ten minutes.
Most breaches at small businesses don’t exploit anything exotic — they walk through a gap the owner didn’t know was open: an un-MFA’d mailbox, a backup no one ever restored, an endpoint running antivirus from a decade ago. A risk assessment is simply the fastest way to find those gaps before an attacker, an auditor, or an insurer does.
Your result is an instant, plain-English score with a tailored action list — no email required to see it, and no sales sequence. If you’d rather have a person walk your environment with you, the call below is free, and there’s no slide deck.