Cyber risk assessment: what it checks, and what a small business gets from it

Short answer: a cyber risk assessment looks at the whole of a small business’s security, not just its network. It combines a vulnerability scan of every device and internet-facing system with a review of the things a scan can’t see: how Microsoft 365 and user accounts are set up, who has admin rights, whether staff passwords have turned up in known breaches, and whether multi-factor sign-in and backups are really in place. You get one report, ranked by what to fix first.

A cyber risk assessment is the right starting point when you don’t know where you stand. That’s most small businesses on the Wirral, in Liverpool and across Cheshire, because security has usually grown by accident rather than been designed. This guide covers what the assessment checks, what it typically finds, and what you get at the end.

Want to know where your business stands? Ring 0151 452 3060 and a person picks up, or see the whole offer, from £55 a person a month.

What a cyber risk assessment checks

1. The network and devices. An internal vulnerability scan of every laptop, PC, server and piece of network kit, looking for missing updates, unsupported software, weak settings and default passwords.

2. What’s exposed to the internet. An external scan of your router, firewall, remote access and any services reachable from outside, which is exactly what an attacker sees first.

3. Accounts and access. Every user account in Microsoft 365 and on the network: who has admin rights, which accounts belong to people who’ve left, which are shared, and which haven’t been used in months.

4. Sign-in security. Whether multi-factor authentication is enforced on every account, including the directors’ and any shared mailboxes. DSIT’s 2025 survey found only 40% of businesses use it on email.

5. Exposed passwords. A check of your business email domain against known breach data, to see whether staff passwords have turned up in someone else’s breach. They’re usually from other websites, and the risk is reuse.

6. Backups and recovery. Whether backups exist for files and Microsoft 365, whether they’re kept separately from the systems they protect, and whether anyone’s restored from them.

Cyber risk assessment vs vulnerability assessment

A vulnerability assessment is items 1 and 2: the scans of your network and internet-facing systems, with a person turning the results into a ranked fix list. It’s the right choice when you know your accounts and backups are in order and want the technical weaknesses found.

A cyber risk assessment is all six. DSIT’s 2025 survey found 85% of attacks start with phishing, and what a phishing email is usually after is a password. That’s why the account, sign-in and password checks often turn up the most important findings. If you’re not sure which you need, start here. Our guide to vulnerability scanning vs penetration testing covers the scanning side in more detail.

What a cyber risk assessment typically finds

Rarely anything dramatic. Usually a handful of ordinary gaps that add up:

• Multi-factor sign-in on most accounts but not all, often a director’s or a shared mailbox.
• Accounts for people who left, still active.
• More people with admin rights than the business realised.
• A laptop or two that stopped updating months ago.
• Staff email addresses in known breaches, with passwords that may still be in use.
• A backup that runs but has never been restored.

Each one’s a specific fix. The value of the assessment is having them all on one page, in order, so they get fixed rather than half-remembered.

Want the assessment done for you? Fixed price, quoted first, run remotely with no disruption to the office. You get a written report and a call to walk through it. Ready to talk? Ring Eric on 0151 452 3060, or see what ongoing IT support costs.

What you get at the end

A written report in plain English, with every finding ranked by how much it matters to your business, not by a scanner’s severity score. Each finding has the fix spelled out, so you can do it yourselves, hand it to your IT provider, or have us do it. Then a call with Eric to walk through it, and a re-scan once the fixes are in to prove they’re closed.

The report doubles as evidence. The findings map onto the Cyber Essentials controls and onto the questions insurers ask, so it’s useful for a cyber insurance renewal, a client’s supplier questionnaire, or getting ready for Cyber Essentials.

Cyber risk assessments on the Wirral, in Liverpool and across Cheshire

The assessment is run remotely, over a secure connection, so it’s the same service for a business in Birkenhead, Liverpool city centre, Chester or Warrington. Nothing needs to stop in the office while it runs. We’re on the Wirral, and if anything needs a visit, it’s booked in.

After the assessment, the question is how to stop the gaps coming back. That’s either continuous vulnerability scanning, or cyber security for Wirral businesses built into your IT support.

Don’t know where you stand? That’s the right time for a cyber risk assessment. Ring Eric this week and you’ll have a fixed price by the end of the call. Ring 0151 452 3060 and a person picks up.