Security Reality Check

The pain

The business owner doesn't know how vulnerable the company is. They don't want a 40-page ISO audit they can't act on anyway — they want to know: am I an easy target, and what is urgent? For those covered by NIS2, regulatory pressure comes on top: everyone has heard of it, but nobody follows it up concretely.

The scan

2 to 3 days. Conversations with key people, a light technical review, and a benchmark against what is the norm today for a company of your size. No pentest theatre, no fear-based selling — an honest picture.

The result: a scorecard (red / orange / green per domain, set against a market baseline) plus the top 5 priorities, each with cost, impact and urgency.

Typical findings

• No multi-factor authentication on the admin accounts or on the owner's own mailbox — while phishing and CEO fraud come in precisely through that mailbox. The cheapest, biggest win there is.
• "We have backups" — but nobody has ever tested a restore. In a ransomware scenario it then turns out the backup was encrypted along, or has been failing for months.
• Accounts of former employees still active. Shared passwords on a note. Everyone with admin rights "because it's easier".
• A NAS, camera system or old server directly exposed to the internet without anyone realising it.
• Nobody can say who has access to which customer data — a GDPR and NIS2 risk in one.
• A cyber insurance policy exists, but its conditions (MFA required, backups tested) are not being met. In case of a claim, there is no coverage.

The follow-up

For those who want to go further: rolling out MFA, setting up a tested backup and recovery strategy, short staff awareness sessions, and where needed a NIS2 compliance trajectory. Companies that have multiple pillars reviewed often move over time to ongoing, recurring IT governance.