Cybersecurity assessments
Know what you don't know.
A risk-prioritized cybersecurity assessment that translates risk into a budget your leadership can actually approve.
The threat landscape
Cyber threats reach every kind of business
Whether you're a 10-person clinic or a 5,000-person enterprise, attackers don't pick targets by size. They pick them by reachability.
Ransomware
Encrypts files and backups. Operations stop for days.
Business email compromise
Attackers impersonate your CEO or a vendor and redirect a wire. Funds are rarely recovered, and insurance often won't cover it.
Data breaches
Sensitive information leaks or gets sold. Legal exposure, regulatory penalties and reputational damage follow.
Malware & insider threats
Custom malware and careless or malicious employees create significant risk.
The common thread
These threats don't need an obvious target, just a reachable one. An assessment finds what's reachable, what would happen if it were exploited, and which gaps are worth closing first. Most leaders assume that's already been done. Most of the time, it hasn't.
The real value
Why this is worth doing
Without an assessment, most security spending is reactive, shaped by news cycles, vendor pitches and whichever threat felt urgent last quarter. An assessment replaces gut feel with a documented risk profile that you, your IT team, your board and your insurer can all work from.
Decisions improve
Investments get prioritized against documented exposure. One risk register guides every conversation: leadership, IT, board and insurer.
Spending matches real risk
Many companies don't underspend on security, they misspend it. An assessment routes every dollar to the gaps that matter.
Tools don't equal coverage
Security tools without the right training, experience and processes create a false sense of security. An assessment checks how well your tools work and what they actually protect.
And there's more
An assessment unlocks more than security improvement
Cyber insurance
Underwriters increasingly want evidence of a recent assessment. Having one can mean lower premiums, fewer denied claims and fewer renewal denials.
Compliance & audits
HIPAA, PCI-DSS, CMMC and FFIEC examiners all expect documented risk assessments. A current one ends the conversation; a missing one starts it.
Defensible posture
When something goes wrong, regulators, insurers and plaintiffs' attorneys all ask the same question: did you have sufficient protections? An assessment is the receipt.
Setting expectations
What an assessment is, and isn't
An honest scope is the best way to avoid mismatched expectations. An assessment is the structured starting point, not the only thing your business will ever need.
- A structured evaluation of your current security posture
- A risk-prioritized list of gaps, in business language
- A defensible record of due diligence for insurance and audit
- An annual rhythm, not a one-and-done exercise
- A penetration test (no exploitation, no red-team simulation)
- A compliance certification (it informs them; it doesn't issue them)
- A vulnerability scan; an assessment is much broader in scope
- The remediation work itself. We identify what to fix; the fixes are a separate engagement, handled by your IT team, your IT provider or DFS
- Continuous monitoring. An assessment is a point-in-time evaluation, so reassess annually
The workflow
How an engagement runs
Information gathering
Interviews with your business and IT to understand operations, your risk profile and existing controls.
Analysis & testing
Depends on tier. Vulnerability scans, configuration reviews and control assessments. Scope grows with the tier.
Reporting
Findings and recommendations, risk-prioritized and written in business language, with remediation steps.
Remediation guidance & follow-up
Practical advice. Extended and Comprehensive include a follow-up interview within 12 months to review progress and update recommendations.
Three tiers, one methodology
Choose the depth. The discipline is the same.
Every tier delivers a risk-prioritized report and remediation roadmap. Depth, technical testing and customization scale with your risk profile and budget. We'll help you size the right tier in a 30-minute call; pricing is scoped to your environment.
| BasicFoundational | ExtendedValue option | ComprehensiveRecommended | |
|---|---|---|---|
| Security controls gap analysis | |||
| Compliance gap analysis (as applicable) | |||
| External vulnerability scan | |||
| Credentialed internal scan | — | ||
| Firewall & M365 configuration reviews | — | ||
| 12-month follow-up interview | — | ||
| Network architecture review | — | — | |
| Security management plan assessment | — | — | |
| Customized in-depth testing | — | — | |
| Reporting detail | Basic | Detailed | Extensive |
Comprehensive is the recommended assessment: the most thorough view of your security posture, with audit-ready documentation. Extended is the value alternative when budget or scope rules out a full audit, and still includes credentialed technical testing and a 12-month follow-up interview.
The tiers in detail
Basic assessment
Foundational visibility in a single conversation: a structured controls interview, a high-level gap analysis, and a deck you can take to your leadership.
Talk to us about BasicA roughly 30-minute structured interview with a knowledgeable representative from your business and your IT resource. A DFS analyst compares your existing controls against an industry-recognized baseline and frames the gaps in the context of your business. Interview-based only: no scans, configuration reviews or control validation.
A concise PowerPoint (10–15 slides) covering current controls, gap areas and high-level prioritized recommendations, written for your decision-makers.
Small organizations new to cybersecurity, with a very limited budget or little executive support for cyber spend, that need a high-level view to make the case for further investment. Not recommended if you have a mature program, compliance pressure or a recent security incident.
Extended assessment
Meaningful improvement at an accessible investment. Basic's controls review, plus credentialed technical testing and a 12-month follow-up.
Talk to us about Extended- 30-minute controls interview
- External vulnerability scan
- Credentialed internal scan (deployed appliance)
- Firewall configuration review (up to two)
- Microsoft 365 tenancy security review
- Follow-up interview within 12 months (no additional technical testing)
- Expanded PowerPoint (15–30 slides) for your leadership
- Detailed written vulnerability report (PDF) for your IT team to remediate
- Updated PowerPoint after the follow-up interview
Organizations without an established security program, with limited budget or executive support, that want an overview plus real technical risk numbers: exploitable vulnerabilities, internal exposure and configuration weaknesses, without the scope and cost of a Comprehensive audit.
An optional high-level HIPAA overlay reviews ePHI-specific risks alongside the standard controls, for small covered entities. It works best as a stepping-stone to a Comprehensive assessment.
Comprehensive assessment
The most thorough view of your security posture. A fully customized, in-depth audit for compliance-driven environments and any situation that needs a full written report.
Scope a Comprehensive assessmentA customized audit tailored to your environment, risk profile and compliance requirements. Scope is set in a formal scoping meeting and detailed in a statement of work, then carried out by senior security professionals through in-depth interviews, documentation review, configuration analysis and a wide range of technical testing.
A full written report (typically 40–300+ pages, Word format) with an executive summary, detailed findings by area, prioritized remediation steps and supporting appendices. Audit-ready and defensible.
Organizations facing HIPAA, PCI-DSS or CMMC requirements, cyber insurance underwriting, board-level risk reporting, or recovery from a recent compromise or data loss. The recommended path for any organization serious about understanding and acting on its security posture.
A 21-section HIPAA overlay addresses every HIPAA Security Rule requirement, with enough documentation to satisfy MIPS Security Risk Assessment audits and covered-entity attestations.
That's the point of a scoping meeting. Regulated environments such as CJIS, CMMC, PCI-DSS and financial services, one-of-a-kind systems, remote or multi-site operations, a recent incident: tell us what you're working with and we'll design the assessment that fits it.
Why DFS
A specialist team, not another vendor pitch
We focus only on cybersecurity risk management, digital forensics, incident response and managed security. DFS was founded in 2005 by a Fortune 500 cybersecurity expert and two law enforcement officers.
Battle-tested by breach responders
Our analysts have responded to active breaches. We know what attackers exploit because we've watched them do it.
Outcomes, not tools
Findings translated to business risk and budget-ready next steps. Reports a CFO can act on, not a stack of CVE numbers.
Trusted intermediary
DFS analysts hold SECRET-level clearances and serve as trusted intermediaries with law enforcement. Every analyst is referral-vetted, background-checked and bound by strict NDAs.
Lean & agile
We stay current on emerging frameworks, tooling and threat intelligence, bringing cutting-edge industry awareness to every engagement without bloated process or stale playbooks.
Ready to know where you actually stand?
We'll help you size the right assessment tier in a 30-minute call. Once you choose, work starts in days, not months.