Many businesses don’t know where their security gaps are until someone finds one for them. A security assessment is how you find them first.
The risks are well documented. In Verizon’s 2026 Data Breach Investigations Report, 31% of breaches started with attackers exploiting software vulnerabilities, making it the most common way in. Ransomware showed up in 48% of breaches. An assessment is built to catch common openings before an attacker does: missing updates, weak sign-in settings and accounts with more access than they need.
Here’s what we look at when we assess a business, and what you get at the end.
Part 1: Your Microsoft 365 Environment
If your business runs on Microsoft 365, it holds your email, your files and the accounts everyone signs in with. We do a full review to find security gaps and misconfigurations, then fix them. That work covers four main areas.
Multifactor Authentication (MFA)
We check that MFA is turned on and enforced for every account, not just offered. It’s one of the simplest protections you can have. Microsoft’s own research shows MFA can block more than 99.2% of account compromise attacks, and CISA recommends that organizations enable MFA to make it harder for attackers to get in, even when passwords are stolen.
Conditional Access
Conditional access sets the rules for who can sign in, and under what conditions. We review those rules and tighten them where needed.
Mail Flow Security
We review how email moves in and out of your organization and the protections around it.
Permissions Review
Over time, people collect access they no longer need. We review who can see and change what, so each account has the access its job requires and nothing more.
Once we’ve found the gaps, we fix them. We implement hardening measures based on best practices, so the assessment ends with a more secure setup, not just a list of problems.
Part 2: Every Computer and Your Office Network
Next, we schedule an on-site visit and assess every workstation and your office network. We look at three things.
- Security best practices: Are your computers and network set up the way they should be?
- Outstanding software updates: Which machines are behind, and on what? Given how many breaches start with unpatched vulnerabilities, this is one of the most important checks we do. (If you run Macs, Apple’s fall updates are a good place to start.)
- General performance: Is anything slowing your people down?
What You Get
At the end of the computer and network assessment, you get a report with our recommendations. It lays out what we found and what we suggest doing about it.
After the Assessment
Security isn’t a one-time fix. Settings drift, new people join and updates keep coming. Once your Microsoft 365 environment is hardened, we can keep it that way with ongoing monitoring and administration, including:
- Regular reviews
- Patch and configuration monitoring
- Proactive adjustments as your needs change
For anything outside that scope, remote support is available as needed during business hours, 9 a.m. to 5 p.m. It’s part of our cybersecurity posture and awareness services, available to sole proprietors, small businesses and enterprises alike.
Getting Started
To begin, we’ll ask for admin access to your Microsoft 365 account and your DNS records. From there, we start the Microsoft 365 review and schedule the on-site visit.
Want to check the basics yourself first? Grab our free Small Business Cybersecurity Checklist.
Not sure where your gaps are? Book a call with Dave and we’ll talk through what an assessment would look like for your business.
