See Your IT Risk Score
Ten quick yes/no questions covering the areas that cause 90% of business-disrupting incidents we see. Answer honestly and you’ll get an immediate score plus where you’re most exposed.
Question 1 of 10
1. Is all your critical business data backed up daily AND tested for restoration?
2. Is multi-factor authentication (MFA) enabled on email, admin accounts, and remote access?
3. Are operating systems and software patches applied within 30 days of release?
4. Do all endpoints (laptops, desktops, servers) have modern endpoint protection?
5. Do you have a written incident response plan and know who to call at 2am?
6. Is your network segmented so that a compromised laptop can’t reach the file server, accounting system, and backups?
7. Have employees received any security awareness training in the last 12 months?
8. When was the last time you reviewed who has access to what, and how quickly are accounts closed when someone leaves?
9. Do your cloud tools (Microsoft 365, Google Workspace, CRM, accounting) use single sign-on or a shared identity provider?
10. Is access to finance, HR, and admin systems limited to the people who genuinely need it, with audit logs of who accessed what?
Want the detailed breakdown? Drop your details below and we’ll send you a question-by-question report with the specific moves that would lift your score the fastest, ranked by impact and effort.
Thank you
Thank you for taking the time to complete your risk assessment.
Now a real person will take the time to review your answers and send your detailed report within one business day.
If you don’t see it, check your spam folder and let us know.
Why an IT Risk Score matters
The businesses that get hit by a serious cyber incident almost never see it coming. Ransomware, wire fraud, prolonged outages, the pattern behind all of them is the same handful of missing controls: no tested backup, no MFA on the accounts that matter, patches that lag, endpoints running whatever antivirus came with the machine. When those gaps line up, an incident that would have been contained becomes one that costs weeks of recovery and six figures in disruption.
Most owners can’t answer the question “how exposed am I right now?” with any confidence. The people who could, internal IT, a general-practice consultant, the outsourced provider, usually can’t either, because they’re grading their own homework. That’s the gap this assessment closes: a short, honest read on your posture that doesn’t need anyone to sell you anything to be useful.
What the 10 questions cover
Each question maps to one of the ten controls that show up over and over in post-incident forensics for small and mid-sized businesses:
- Backup and recovery: not just whether backups run, but whether they’ve been tested end-to-end recently enough to matter.
- Multi-factor authentication: on the accounts an attacker would actually target, not just the ones that were easy to turn it on for.
- Patch discipline: the window between a vendor release and it being installed across your fleet.
- Endpoint protection: whether the laptops, desktops, and servers run something modern (EDR/MDR) or something 2015 called and wants back.
- Incident response: whether there’s a written plan and the person who owns it can be reached at 2 AM.
- Network segmentation: whether a compromised laptop can reach the file server, the accounting system, and the backups.
- Security awareness: whether staff have seen any training in the last year, so the humans are as defended as the wires.
- Access reviews and offboarding: whether accounts get closed the day someone leaves and access gets checked before it drifts.
- Single sign-on: whether cloud tools sit behind a shared identity provider or every app has its own password to leak.
- Least privilege: whether access to finance, HR, and admin systems is limited to the people who genuinely need it, with audit logs to prove it.
How to read your score
You’ll get a score out of 30, plus a plain-English band that tells you where you sit relative to the businesses we see. High scores don’t mean “buy nothing” and low scores don’t mean “emergency”, they mean the specific controls you should look at first. You see the score immediately. If you want the question-by-question breakdown with the moves that would lift each area the fastest, you can request the detailed report at the end.
Who this is for
Owners and operators of small and mid-sized businesses who want a straight answer on where they stand. IT managers who need something to hand a skeptical CFO. Operations leaders who inherited a stack they didn’t build and aren’t sure what’s in it. If you already have a mature security program, the score will confirm that. If you don’t, it’ll tell you exactly which gap to close first.