How Do I Know If My Business Is Secure?

The Uncomfortable Truth

Most businesses think they're secure until they're breached.

Common assumptions that aren't validated:

• "Our IT guy handles security"
• "We have antivirus"
• "We're too small to target"
• "We use cloud, so we're secure"

Reality: Without testing, you don't know.

Quick Self-Assessment

Start here. Answer honestly:

Identity and access

• [ ] MFA enabled on all accounts?
• [ ] No shared accounts?
• [ ] Admin access limited to those who need it?
• [ ] Leavers removed promptly?

Patching and updates

• [ ] Operating systems current?
• [ ] Applications updated?
• [ ] Firmware on network devices current?
• [ ] No end-of-life software?

Backup and recovery

• [ ] Backups running and verified?
• [ ] Backups tested (actually restored something)?
• [ ] Backups protected from ransomware?
• [ ] Know your recovery time?

Email and web

• [ ] DMARC configured?
• [ ] Spam filtering adequate?
• [ ] Link/attachment protection?

Endpoint protection

• [ ] EDR or antivirus on all devices?
• [ ] Centrally managed?
• [ ] Alerts monitored?

If you have unchecked boxes, you have known gaps.

Levels of Security Assessment

1. Self-assessment (free)

What you just did above. Good starting point, limited depth.

2. Security health check (£500-2,000)

Professional review of your basics:

• Configuration review
• Policy assessment
• Quick vulnerability scan
• Recommendations report

Good for understanding your position without major investment.

3. Vulnerability assessment (£1,000-5,000)

Technical scanning of your systems:

• External vulnerability scan
• Internal vulnerability scan
• Prioritised findings
• Remediation guidance

Finds technical weaknesses systematically.

4. Penetration testing (£3,000-15,000+)

Simulated attack by security professionals:

• Attempts to exploit vulnerabilities
• Tests defences in depth
• Proves what's actually exploitable
• Most thorough assessment

Best done after you've fixed the basics.

5. Security maturity assessment (£5,000-20,000+)

Comprehensive programme review:

• Governance and policy
• Technical controls
• Processes and procedures
• People and culture
• Benchmarked against frameworks

For organisations wanting strategic improvement.

What "Secure" Actually Means

Security isn't binary. You're never 100% secure. The question is: Are you secure enough for your risk profile?

Factors that determine "enough":

• What data do you hold?
• Who might target you?
• What are the consequences of breach?
• What do customers/regulators expect?
• What can you afford?

Secure enough means:

• Basics are solid
• Known risks are managed
• Detection capability exists
• Recovery is possible
• Continuous improvement happening

Warning Signs You're Not Secure

Obvious:

• No MFA
• Patching backlog
• No backup testing
• No security training

Subtle:

• No one's responsible for security
• Security is "IT's problem"
• Incidents aren't documented
• Can't answer customer security questions
• Insurance application was difficult

How We Help

We provide assessments at every level:

• Quick health check - Where do you stand?
• Vulnerability scanning - What's exposed?
• Gap analysis - What needs fixing?
• Ongoing management - Stay secure

Knowing where you are is the first step to getting where you need to be.