Cybersecurity Posture Assessment

How to read the result

The gaps are ranked by exposure rather than by effort, so the first item is not necessarily the easiest one. Controls map to NIST CSF 2.0 functions and the CIS Critical Security Controls v8.1, which means the output can be taken into an existing programme without translation and compared against what you already claim to have in place.

A risk rating of HIGH here means the answers describe an estate where a common attack path is not covered, not that a breach is imminent. The value is in which path, and the named controls are the shortest route to closing it.

What it cannot see

This is a questionnaire, not an audit and not a test. It cannot verify that a control you reported as present is actually operating, and the gap between a control that exists and one that demonstrably ran is where most real incidents live. It also cannot see your architecture, your third parties or anything about your identity estate beyond what you tell it.

What to do next

For each recommended control, find the evidence that it operated in the last thirty days. Where that evidence does not exist, treat the control as absent regardless of what the questionnaire says, because that is how an assessor, a regulator and an attacker will each treat it. The assessment runs in your browser and none of your answers reach us.