Security assessment
Where do you really stand, and what should you fix first? I review your exposure and your defences the way an attacker and an incident responder would, and give you a short, prioritised roadmap instead of a catalogue of everything that could be better.
When it makes sense
- You don't know where to start with security, or where to spend the budget
- A customer, an insurer or management asks for an overview of your security
- Your IT has grown over the years and nobody has the full picture any more
- After an incident, to check what else needs fixing
- Before a penetration test, to fix the obvious first
How I work
- 01
Kick-off
A short meeting to understand your business, your IT and what matters most to you.
- 02
Review
Interviews with your IT team or provider, configuration reviews and checks of your external exposure.
- 03
Analysis
Findings ranked by real risk: how likely an attacker is to use them, and what it would cost you.
- 04
Roadmap
Quick wins for the coming weeks, and the larger projects for the coming months.
- 05
Debrief
A meeting with management and IT to agree on priorities.
What you get
- A short report with your main risks, in plain language
- A prioritised roadmap, from quick wins to larger projects
- Technical details for your IT team or provider
- A debrief meeting with management and IT
Why Cyber Horizon
- Recommendations based on how real attacks happen, from someone who investigates them
- Both sides covered: penetration testing and incident response
- GIAC Security Expert (GSE)
- Clear priorities instead of a 200-page report
Frequently asked questions
How is it different from a penetration test?
A penetration test actively attacks a defined scope to prove what an attacker could do. An assessment looks at your whole security posture and tells you what to fix first. Many companies start with an assessment.
How long does it take?
Usually a few days for a small or medium company, spread over one to three weeks.
Is the free exposure check the same thing?
No. The free exposure check only looks at what is visible from the internet. The assessment also covers what happens inside: accounts, endpoints, backups and detection.
Will my IT provider be involved?
Yes, ideally. They know your environment, and the roadmap is more useful if they help build it.