What Does a Cybersecurity Assessment Actually Check? A Plain-English Guide

A cybersecurity assessment reviews the security controls already in place across your devices, email, network, accounts and backups, then reports where the gaps are and which ones matter most. It is a structured inspection of what you have, not a sales exercise and not an attack simulation. A good one ends with a written, prioritised list of things to fix — and an honest note about what is already fine.

Most business owners have been offered one and are not sure what they would be paying for. Here is what actually happens.

The seven areas a proper assessment covers

1. Endpoints — the devices themselves

Every laptop, desktop, server and phone that touches company data. The questions are: is protection installed, is it actually running, is it reporting to somewhere a human looks, and is the operating system still receiving security updates. The most common finding is not an absence of antivirus — it is antivirus that stopped reporting months ago on three machines nobody noticed. Endpoint protection that nobody monitors is a licence, not a control.

2. Email — where most incidents begin

We check filtering and anti-spoofing configuration, whether DMARC, SPF and DKIM records are correctly set so attackers cannot send mail that appears to come from your domain, whether forwarding rules exist that nobody created, and whether multi-factor authentication is enforced on every mailbox rather than most of them. Attacker-created forwarding rules are a classic finding: a quiet copy of every invoice going somewhere else.

3. Identity and access

Who can reach what, and should they still be able to. This is where assessments most often surprise people. Accounts belonging to staff who left. Shared logins that several people use, so no action can be traced to a person. Administrator rights granted for one task two years ago and never removed. Multi-factor authentication enabled for the team but skipped for the owner, who is the highest-value target in the company.

4. Network and firewall

Whether the firewall is doing more than routing traffic, whether its firmware is current, whether remote access is exposed directly to the internet, whether guest Wi-Fi is genuinely separated from the business network, and whether the equipment is still supported by its manufacturer. Hardware that reached end-of-life stops receiving security fixes; it keeps working perfectly while quietly becoming the weakest point in the building.

5. Backups — and whether they actually restore

The question is never “do you have backups”. It is: when did you last restore from one, how long did it take, and is a copy held somewhere ransomware cannot reach. A backup on a drive permanently connected to the server gets encrypted along with everything else. We verify that restores work rather than accepting a green tick on a dashboard, because the dashboard is reporting that a job ran, not that the result is usable. Tested cloud backup is the single control that most reliably turns a disaster into an inconvenience.

6. Patching and software currency

Which systems are missing updates, how long they have been missing them, and whether anything critical is running software the vendor no longer supports. Line-of-business applications are the usual culprit — the accounting or scheduling system that only runs on an old version of Windows, so the machine never gets touched.

7. Exposure you cannot see from inside

Company credentials already circulating from breaches at other services, domains registered to look like yours, and services accidentally published to the internet. Staff reuse passwords; that is human. A breach at an unrelated website becomes your problem when the same password protects your email.

What the report should look like

A useful assessment produces a written document you can act on without the assessor present. At minimum it should contain:

• Findings, prioritised by risk — not a flat list of everything, but what to fix first and why
• Plain-language explanations — what each finding means for your business, not just its technical name
• Effort and cost indication — so you can decide what to do now and what can wait
• What is already working — an assessment that finds nothing good is selling, not assessing

If the output is a red-and-green scorecard with no explanation, or a list of products to buy, you have received a sales document with an assessment’s title on it.

Assessment, vulnerability scan or penetration test?

These three get used interchangeably and mean quite different things.

• Cybersecurity assessment — a broad review of controls, configuration and process. Answers: how are we set up, and where are the gaps?
• Vulnerability assessment — automated scanning for known weaknesses in systems and software. Answers: what unpatched or misconfigured issues exist right now?
• Penetration testing — a controlled attempt to actually break in. Answers: can someone get in, and how far can they get?

The order matters. A penetration test against an environment that has never had an assessment usually finds the obvious problems an assessment would have found for a fraction of the cost. Assess first, fix, then test whether the fixes hold.

How long it takes and what it costs

For a business with ten to fifty staff, an assessment typically takes a few days of work: gathering data from your systems, reviewing configuration, and writing the report. It is not disruptive — most of it happens in the background without touching anyone’s day.

Pricing varies with size and how much of your data is regulated. Be wary of a free assessment that arrives with a quote attached and no written findings; the assessment is the deliverable, and you should own it regardless of who does the remediation afterwards.

What to do with the findings

Most reports break into three groups. A small number of items should be fixed this week — usually multi-factor authentication gaps, accounts belonging to people who have left, and backups that are not actually working. A larger group can be scheduled over the next quarter, such as patching discipline, firewall replacement, or access reviews. A third group is genuinely optional and depends on your risk appetite.

The failure mode here is not disagreement — it is a report that gets read once, agreed with, and then sits in a folder while everyone returns to their actual jobs. Ongoing managed IT services exist largely to make sure the second and third groups actually happen, and that new gaps get caught as things change.

Frequently asked questions

How often should we have a cybersecurity assessment?

Annually for most small and medium businesses, and additionally after any significant change — an office move, a merger, a shift to remote work, or a new line-of-business system.

Will an assessment disrupt our business?

No. Assessment is largely read-only: reviewing configuration and collecting data. Nothing is changed without your agreement, and nothing needs to be taken offline.

Do we need one for cyber insurance or compliance?

Insurers increasingly ask for evidence of specific controls, and regulated sectors need to demonstrate documented safeguards. An assessment report is usually the most straightforward way to show both.

What if the assessment finds a lot of problems?

That is a normal outcome, not a failure. Most small businesses have never had their setup reviewed by anyone. Findings are prioritised precisely so you can deal with what matters first rather than everything at once.

Insmart Technology provides cybersecurity services for businesses in Surrey and across the Lower Mainland, including assessments with written, prioritised findings you keep regardless of what you do next.

About the author: Naqash Bin Iqbal is an SEO Specialist at Insmart Technology, a Surrey-based managed IT and cybersecurity provider.