Security Risk Assessments

Part of Security Risk, Compliance and Advisory

You cannot fix everything at once. A risk assessment shows what you have, what could realistically go wrong and what to do first, in terms leadership can act on.

What we assess

Assets and data. What matters most to the business and where it lives.
Threats and likelihood. The ways a threat actor or an honest mistake could harm those assets, informed by what we see in real incidents.
Controls. Identity and access, email, endpoints, backups, logging, patching and incident readiness.
Microsoft 365. Audit logging, conditional access, legacy authentication, app consent and administrator separation.
People and process. Who decides what during an incident, and whether the plan has been tried.

How it works

Scope. Agree the business units, systems and standards in play.
Gather. Interviews, configuration review and evidence collection.
Analyze. Rate each risk by likelihood and impact, and note existing controls.
Report. Present findings and a prioritized roadmap, with a walkthrough for your team and leadership.

What you receive

An executive summary of your cyber risk
A risk register with each item ranked
A security roadmap in realistic steps
Mapping to frameworks such as HIPAA, FISMA and ISO where relevant, see compliance and framework support

Why incident experience matters

Our team investigates real compromises, so the assessment looks at the controls that decide outcomes in practice: logs that exist when you need them, MFA that stolen sessions cannot bypass, and email rules and app grants that someone is watching. Our team has delivered hundreds of assessments, has worked with large enterprises including Fortune 50 organizations, and has experience with HIPAA, FISMA and ISO frameworks and with nation-state and APT-level threat actors.

Next steps after the assessment

The roadmap can feed directly into managed security services, penetration testing and cyber insurance readiness.

Get in touch

Prefer to write? Email info@core-infosec.com or use the contact form. We reply to form and email enquiries by the next business day. Ask us about incident response retainers as well.