Cybersecurity Risk Assessment
22 questions across seven control areas: get your cyber risk level and the fixes that cut the most risk first.
Example scenario—not a forecast or verified benchmark. Enable JavaScript to edit inputs, view charts, save locally and export your analysis.
Example inputs
- MFA is required on email for every user.
- 4
- MFA is required on banking, payroll, remote access, and cloud admin accounts.
- 3
- Staff use accounts with admin rights for everyday work, or share logins.
- 3
- Access is removed the same day an employee or contractor leaves.
- 3
- We keep at least one backup copy offline or immutable (ransomware cannot reach it).
- 3
- Cloud data (Microsoft 365 / Google Workspace, CRM) is backed up separately.
- 2
- We have tested a full restore in the past 6 months.
- 2
- Operating systems and browsers update automatically on all devices.
- 3
- Every laptop and server has managed antivirus / endpoint detection (EDR).
- 3
- We still run unsupported software or devices (e.g., old Windows versions, end-of-life routers).
- 3
- SPF, DKIM, and DMARC are configured on our email domain.
- 2
- Suspicious attachments and links are filtered or sandboxed before reaching inboxes.
- 3
- Any change to payment or bank details requires call-back verification on a known number.
- 2
- All staff complete security awareness training at least annually.
- 2
- We run phishing simulations and track who clicks.
- 2
- Staff know exactly how to report a suspicious email or incident.
- 3
- We have a written incident response plan with named roles and contacts.
- 2
- We have cyber insurance and know what it requires of us.
- 3
- Security logs (sign-ins, admin changes) are monitored and alerted on.
- 2
- We know where all sensitive customer, employee, and payment data is stored.
- 3
- Access to sensitive data is limited to people who need it.
- 3
- Key vendors with access to our systems or data meet written security requirements.
- 2
Example results
Cyber risk level: High (security score 41/100), with 2 critical gaps to close first. Weakest area: Backups & recovery at 33/100.
- Security score (higher = lower risk)
- 41/100
- Risk level
- High
- Critical control gaps
- 2
- Backups & recovery
- 33/100
- Email security
- 33/100
- Security awareness
- 33/100
- Incident response
- 33/100
- Vendors & data
- 42/100
- Patching & devices
- 50/100
What stands out
2 critical control gaps
Restores never tested; No payment-change verification. These are the controls attackers and cyber insurers check first.
Backups & recovery: 33/100 (Critical risk)
Keep at least one backup copy offline or immutable, back up cloud apps (Microsoft 365/Google), and test a full restore quarterly.
Email security: 33/100 (Critical risk)
Configure SPF, DKIM, and DMARC, turn on advanced phishing filtering, and require call-back verification for any payment change.
Security awareness: 33/100 (Critical risk)
Run short quarterly security training plus monthly phishing simulations, and make reporting suspicious email easy.
Next actions
- Within 30 days, close the critical gaps: restores never tested; no payment-change verification.
- Keep at least one backup copy offline or immutable, back up cloud apps (Microsoft 365/Google), and test a full restore quarterly.
- Configure SPF, DKIM, and DMARC, turn on advanced phishing filtering, and require call-back verification for any payment change.
- Run short quarterly security training plus monthly phishing simulations, and make reporting suspicious email easy.
Model assumptions & limitations
- Access & MFA and Backups & recovery are weighted 1.3x because they most often determine whether an incident becomes a business-stopping event; weights are judgment, not a standard.
- Critical gaps are flagged when a foundational control is answered 1–2 out of 5.
- Self-reported answers; this is a screening tool, not a penetration test or compliance audit.