Cybersecurity risk assessment
Cybersecurity risk assessment for your business
A fixed-scope, expert-led review of your security in 10 business days, ending with a written roadmap and a briefing for your leadership team.
No obligation · Response within one business day
When an assessment is the right first step
Same method, same deliverables, every time.
You need an independent baseline
Before choosing a vCISO, an IT provider or new tools.
Someone wants evidence
An insurer, client or acquirer wants evidence, not a self-assessment.
You want a second opinion
Whoever runs your IT says things are fine, and you want to check.
Something happened
You need to know what else is exposed.
What the assessment covers
We look from the outside in, then from the inside, and write down what we find.
Outside in
- External attack surface review: what your firm exposes to the internet
- Leaked credential checks for your domain, including dark web sources
Inside
- Vulnerability assessment of critical systems
- Identity and access review: multi-factor sign-in, passwords, dormant and admin accounts
- Cloud, SaaS and backup checks
- AI tool use review
What you receive
- Executive summary of findings, rated by business impact
- External exposure and leaked credential report
- A prioritized 30-day remediation roadmap
- A 60-minute briefing with your leadership team, with the slides
Ten business days, start to finish
A findings report, a 30-day roadmap and a leadership briefing, in 10 business days.
- Phase 1Kickoff and data gatheringWe send your team a short questionnaire and collect what we need: IP ranges, cloud services, endpoints and key assets.
- Phase 2External review and scanningWe review your external attack surface, check for leaked credentials, and scan critical external and internal systems.
- Phase 3Identity, cloud and backup reviewWe check multi-factor sign-in, password and account hygiene, AI tool use, cloud configuration, encryption and backups.
- Phase 4Report and briefingFindings and a 30-day roadmap in one report, then a 60-minute session with leadership. No jargon.
How the assessment is scoped
A fixed method and a fixed 10-business-day timeline. The fee is set in writing before work starts.
After the assessmentAct on the roadmap through a vCISO retainer, or hand it to whoever runs your IT. Either is fine.
What sets the fee
- Locations, users and systems
- How much is in scope.
- Your external footprint
- Domains, public IP ranges and cloud services.
- Requirements the report must address
- Any regulatory or contract requirement.
Who this is for
A good fit
- Businesses that need an independent baseline
- Leadership teams preparing for insurance renewal, a client review or a transaction
Not a fit
- Firms that need a formal compliance certification. We prepare you; we do not certify.
What we do not do
- Certify, attest or sign off audits
- Fix the findings ourselves during the assessment (the roadmap says who should)
Need someone to own the roadmap afterwards? Fractional CISO
Questions about the assessment
More in the full FAQ
How much does a cybersecurity assessment cost?
The fee is fixed in writing before we start. It depends on the number of locations, users and systems in scope, the size of your external footprint, and any regulatory requirement the report must cover. A 30-minute call is enough to scope it.
How long does a cybersecurity risk assessment take?
Ten business days from kickoff to the leadership briefing.
How much of our team's time does it need?
A kickoff call, a short questionnaire, access to the information we list, and the 60-minute briefing.
Is this the same as the free assessment?
No. The free assessment is ten yes-or-no questions you answer yourself in a few minutes. This assessment is carried out by us, with external review, scanning and configuration checks.
Will the scans disrupt our systems?
Scanning is planned with whoever runs your IT, limited to agreed systems and scheduled to avoid disruption.
Is this an audit or a certification?
No. It is an independent risk assessment. It helps you prepare for audits and questionnaires but does not certify compliance with any standard.
What happens after the assessment?
You own the report and the roadmap. You can act on it with whoever runs your IT, or with a NightFortress vCISO retainer.
Know what to fix first
A 30-minute call to scope it, then a fixed fee in writing before we start.
Urgent concern? Call 202-909-8237