Know exactly where you stand — and what to fix first.

A structured review of your people, processes and technology against recognised frameworks such as Cyber Essentials, the NCSC 10 Steps and ISO 27001. It covers identity and access, endpoints, email, cloud, backups, network, supplier risk and incident readiness, finishing with a ranked risk register and a prioritised, costed remediation roadmap.

We hold structured workshops with your team to understand the business, systems and risk appetite, then our consultants review policies, technical configurations and controls against UK best practice. You receive a clear, board-ready report with both an executive summary and a technical appendix, plus a walkthrough of the prioritised roadmap so everyone understands what to fix first.

It's very difficult to spot your own blind spots, and an internal review often lacks the benchmark of recognised frameworks. An independent, plain-English assessment gives your board evidence-based, unbiased findings they can trust and act on, rather than an internal opinion that may be shaped by existing assumptions. An independent review also carries far more weight with insurers, auditors and larger customers who ask how you manage cyber risk. Because we assess against recognised frameworks such as Cyber Essentials, NCSC guidance and ISO 27001 themes, you get a benchmark rather than a subjective view.

Fixed-fee engagements start from around £1,950, priced according to the size and complexity of your environment. We agree a clear quote upfront after a short scoping call, so there are no day-rate surprises once the review is under way. That fee covers interviews with your team, technical review of your Microsoft 365 or Google Workspace tenant, endpoint and network configuration, policy review and a prioritised remediation roadmap. If your environment is unusually simple, we will say so and quote less.

Typically 2–4 weeks from kick-off to final report, depending on the size of your business, the number of systems in scope and how quickly information and access can be provided by your team. Most of the effort falls on us rather than you: expect around two to three hours of your team's time in total for interviews and access. We share significant findings as we go, so you can start fixing urgent issues before the final report lands.

It's suitable for any SME wanting an honest, independent view of where it stands — you don't need a formal board to benefit. Many owner-managed businesses commission an assessment simply to understand risk clearly before making a security investment decision. It is equally useful when a new customer, insurer or regulator has started asking questions you cannot currently answer with evidence. The output is written in plain English for a business audience, with a separate technical annexe for whoever will do the remediation work.

An assessment looks broadly across your people, process and technology posture; a penetration test goes deep on technical exploitation of a specific system. They answer different questions, and many clients commission both — an assessment to understand overall risk, then a pen test to validate specific technical controls. If you are unsure which you need, start with the assessment. It will tell you whether a pen test is worth commissioning and, crucially, what it should be scoped to cover so you do not pay to test the wrong thing.

You can hand the prioritised roadmap to your in-house IT team, your existing MSP, or ask us to deliver the remediation ourselves — it's entirely your choice. Either way, we run a working session with you to agree next steps so the report doesn't just sit on a shelf. The roadmap is deliberately written so a competent IT provider can act on it without further input from us. Where you want us involved, we can deliver the fixes ourselves or simply review the work once complete and confirm the risk has genuinely been closed.