Cyber Resilience & Threat Readiness Assessment™

Cyber Resilience & Threat Readiness Assessment™

Know the attacks your organization is prepared for and identify the threats you remain vulnerable to.

Get Your Cyber Threat Readiness Brief

Built for CIOs, CTOs, CISOs, Heads of IT and senior technology leaders. Takes about 7–10 minutes.

Cyber Resilience Score™Measure your overall readiness across key security domains.
Threat Readiness Matrix™See attacks you are prepared for and those likely to succeed.
Industry Threat ImplicationsUnderstand current and future business impact based on your sector.

Organization Profile

How to answer: 1 = Not implemented, 3 = Partially managed, 5 = Mature and consistently monitored.

Security Governance

Security risks are reported to senior management with clear business impact and ownership.
Security policies are documented, reviewed, and enforced across the organization.
Regulatory and compliance obligations that affect IT and cybersecurity are tracked and actively managed.
Cybersecurity decisions are linked to business continuity, revenue protection, and operational resilience.

Identity & Access Security

Multi-factor authentication is enforced for critical systems, email, cloud platforms, VPN, and privileged users.
Privileged accounts are monitored, reviewed, and restricted to users who truly need them.
Joiner, mover, and leaver access changes are controlled quickly when staff roles change.
Dormant, shared, or high-risk accounts are identified and removed or controlled.

Endpoint Protection

All laptops, desktops, and servers are protected by centrally managed endpoint security.
Endpoint security includes detection and response capability, not only traditional antivirus.
Critical systems are patched within a defined and monitored timeframe.
USB and removable media risks are controlled where they could affect the business.

Email Security

The organization has controls to reduce phishing, malware, spoofing, and business email compromise.
SPF, DKIM, and DMARC or equivalent email authentication controls are implemented and reviewed.
Users are trained to identify suspicious emails, payment diversion attempts, and executive impersonation.
High-risk email events are investigated and reported to IT/security leadership.

Network Security

Firewalls and network security devices are actively managed, monitored, and reviewed.
Critical systems are segmented so that one compromise does not easily spread across the organization.
Remote access is secured with strong authentication, logging, and defined access rules.
Network traffic and unusual activity can be investigated when incidents occur.

Cloud Security

Cloud and SaaS environments such as Microsoft 365, Azure, AWS, Google Cloud, or business apps are governed and monitored.
Cloud administrator accounts and risky permissions are reviewed regularly.
Cloud misconfigurations, public sharing, and data exposure risks are checked.
Cloud activity logs are available for investigation and incident response.

Detection & Response

Security events are monitored regularly, either internally or through an MDR/SOC provider.
There is a documented incident response plan with clear roles and escalation paths.
The organization can investigate suspected ransomware, phishing, credential theft, or data leakage quickly.
Incident response exercises or tabletop simulations are conducted periodically.

Backup & Recovery

Critical data and systems are backed up automatically and protected from ransomware.
Backups are tested to confirm the business can restore when needed.
Recovery time expectations are agreed for critical systems.
The organization has a documented disaster recovery approach for major cyber incidents.

Security Operations

There is an up-to-date inventory of assets, applications, servers, and critical systems.
Vulnerability scanning or security reviews are conducted regularly and tracked to closure.
Penetration testing or independent security testing is performed for critical environments.
Security exceptions, risks, and unresolved issues are documented and reviewed.

Human Risk

Staff receive regular security awareness training relevant to their roles.
Executives, finance teams, and privileged users receive additional training on high-impact threats.
Insider threat, third-party access, and vendor security risks are reviewed.
There is a clear way for employees to report suspicious activity or security concerns.

Generate Your Cyber Threat Readiness Brief

Your brief result will show your Cyber Resilience Score™, prepared threats, vulnerable threats, and industry-specific implications.