What a security assessment is, and what it isn't
A security assessment is a structured review of a client's security tools, settings and processes against a known standard of good practice. Its job is to show what is protected, what isn't, and what to fix first.
It is not a penetration test. A pen test has a tester actively try to break in to prove an attack path. It is also not a certification. An assessment can tell you how ready a client is for a standard such as Cyber Essentials, ISO 27001 or NIST CSF, but only an accredited body certifies. And it is not a vulnerability scan on its own. A scan lists known software weaknesses, while an assessment puts those findings in context alongside identity, backup, email and monitoring.
What a good assessment covers
Whatever the provider calls them, look for coverage of these areas:
- Identity and access: MFA on email, remote access and admin accounts, privileged accounts, leavers' accounts.
- Endpoints and servers: protection in place on every device, patching within an agreed time, unsupported systems.
- Email and collaboration: phishing and spoofing protection, sharing settings, mailbox rules.
- Backup and recovery: whether backups exist, are separated from the main network, and have actually been tested.
- Network and perimeter: firewall configuration, remote access, what is exposed to the internet.
- Monitoring and response: whether alerts are collected, and whether anyone looks at them out of hours.
- Governance: policies, incident plans, supplier access and staff awareness.
A good assessment also asks a question many skip: is anyone watching this? A tool that's switched on but never monitored gives much less protection than the dashboard suggests.
Read-only vs hands-on access
Ask exactly what access the provider needs. Many baseline reviews work through read-only connections to existing tools and change nothing. Deeper reviews may install temporary agents or a network sensor for a set period to watch real traffic. Both are legitimate. What matters is that the provider says clearly what is installed, by whom, for how long, and how it is removed. Avoid anyone who wants standing admin rights to run an assessment.
Three common types of assessment
- Baseline review: a broad, fast look at the whole security setup, usually written for the business owner. It typically takes a week or two.
- Technical deep dive: observing the network and servers over a period of days, plus internal and external vulnerability scans. It's written for the technical team and ends in a detailed fix plan.
- Compliance readiness: checking controls one by one against a named framework, showing which evidence exists and which is missing. It is useful before a certification, an insurance renewal or a customer security questionnaire.
Many clients start with a baseline and go deeper only where the baseline shows a gap. Specialist reviews also exist for operational technology (production lines, building systems) and for AI tools and data safety.
What good output looks like
The report is the product, so ask for a sample before you commit. A useful report has:
- A plain-English summary a business owner can read in five minutes.
- A clear status for each area (for example covered, partly covered, not covered) rather than a single abstract score.
- Findings ranked by real business risk, not just by technical severity.
- A practical fix plan, such as now, next and later, with the likely disruption of each change.
- A technical appendix your engineers can work from.
- Something you can track over time, such as a dashboard or a repeatable scoring method.
Be wary of a report that's mostly a raw scanner export with a cover page.
Who signs it off
Ask who reviews the findings and what qualifies them. Look for named, experienced security professionals with recognized security certifications. Someone senior should stand behind the conclusions.
White-label and client-relationship questions
If you partner with a provider, the client relationship should stay yours. Ask:
- Can the report and any dashboard carry your brand?
- Will the provider ever contact your client directly, or try to sell to them?
- Who presents the findings, and can the provider support you on that call?
- Who owns the data, where is it stored, and when is it deleted?
Follow-up and re-scoring
An assessment only reduces risk if the fixes happen. Check what support comes after the report: guided follow-up calls while your team makes changes, help with tricky fixes, and an option to re-score after a few months. A re-score shows your client measurable progress, and it often becomes the case for ongoing work.
Red flags
- Promises of "compliance" or "certification" from an assessment alone.
- No sample report, or a sample that's just scanner output.
- Vague scope ("we check everything") with no list of areas.
- Requests for permanent admin access.
- No named reviewer or stated qualifications.
- Findings that aren't ranked, or no fix plan.
- Pressure to buy a specific product as part of the fix plan.
Questions to ask any provider
- Which areas do you cover, and what is out of scope?
- What access do you need, and what, if anything, do you install?
- How long does it take from access to report?
- Can I see a sample report?
- Who reviews and signs off the findings, and what are their qualifications?
- Is it a pen test, a scan, or a review, and do you map to frameworks my clients use?
- Can the output carry my brand, and will you ever contact my client?
- What follow-up is included, and can we re-score later?
- How is client data handled, stored and deleted?
- Is the fee fixed up front, or can it change once work starts?
A good provider will answer all ten without hesitation.