Cybersecurity assessments
Assess current security controls, evidence and ownership, then turn verified findings into a prioritized and operationally realistic improvement plan.
What we review
- Identity and privileged access: Administrative roles, authentication controls, service accounts, access paths, joiner and leaver practices, and recovery access.
- Endpoints, servers and core platforms: Hardening, patching, supported versions, endpoint protection, administrative boundaries and configuration management.
- Network and remote access controls: Segmentation, Internet exposure, firewall enforcement, VPN or zero trust access, management networks and trusted paths.
- Cloud and externally hosted services: Account structure, public exposure, access policy, security settings, logging and dependencies that cross provider boundaries.
- Detection and operational response: Log sources, retention, alert handling, escalation, incident roles and the ability to reconstruct material events.
- Vulnerability and configuration management: How issues are identified, validated, prioritized, assigned, tracked and rechecked after remediation.
- Recovery and third-party dependencies: Backup administration, restoration evidence, critical suppliers and single points of operational dependence.
Deliverables
- Scope and evidence register: Systems reviewed, access used, interviews completed, evidence examined, assumptions and known coverage gaps.
- Current-state summary: A concise account of the environment, material dependencies and controls that shape the findings.
- Prioritized findings: Each material finding includes evidence, affected service or asset, risk reasoning, recommended action and suggested owner.
- Remediation roadmap: Actions separated into urgent containment, planned improvement and longer-term design work, with dependencies called out.
- Technical working session: A review of findings with the people who will decide, implement and support the work.
- Decision-ready summary: The few choices that need leadership attention, including accepted risk, resource constraints and sequencing decisions.
Engagement boundaries
- The assessment provides a point-in-time review of the agreed scope. It does not promise that an environment is secure or that every weakness will be found.
- Included: Review of evidence and configuration made available within the agreed scope.
- Included: Non-disruptive validation techniques unless a different method is approved in writing.
- Included: Clear notation where access, timing or evidence limits confidence.
- Included: Recommendations that account for operations, change control and recovery.
- Not included: Penetration testing, social engineering, exploit development or destructive testing unless separately scoped and authorized.
- Not included: A legal opinion, formal certification or guarantee of compliance.
- Not included: Remediation implementation, product procurement or continuous monitoring unless added to the engagement.
- Not included: Review of systems, subsidiaries, suppliers or data that are outside the agreed boundary.
Questions before the work starts
Do we need complete documentation before the assessment starts?
No. Existing documentation is useful, but incomplete records are common. The engagement identifies missing evidence and confirms current state through configuration, interviews and observed behaviour where access permits.
Can the assessment follow a specific framework?
Yes. A framework or customer requirement can be used to organize the review. Findings will still be tied to the actual service, evidence and operating risk rather than treated as checklist results alone.
Will the assessment include vulnerability scanning?
It can. The need, targets, timing, credentials and safety controls are agreed during scoping. Existing scan results can also be reviewed and validated instead of running another scan.
How disruptive is the work?
The default approach is read-only and non-disruptive. Interviews and evidence requests require staff time. Any active test that could affect availability requires explicit approval, a defined window and a stop condition.
Can HAI Consulting help after the report is delivered?
Yes. Follow-on work can include remediation planning, design review, change review or validation of completed actions. Implementation work is scoped separately so responsibilities and production access remain clear.
The platforms this work covers
Assessment work covers the platforms an environment actually runs on, rather than a generic checklist.
- Microsoft 365 and Entra ID
- Microsoft Azure
- Amazon Web Services
- Cisco
- Palo Alto Networks
- Check Point
- Fortinet FortiGate
- F5
- Cloudflare
- On-premises and colocation data centre
Audits available
- Microsoft 365 tenant audit: identity, privileged roles, conditional access, mail flow, sharing and audit logging.
- Azure subscription audit: subscription and resource-group boundaries, role assignments, network exposure, key and secret handling, diagnostic logging.
- AWS account audit: account structure, IAM roles and policies, public exposure, guardrails and CloudTrail coverage.
Other ways we can help
Engagements are often scoped together; these are the closest neighbours to this one.
Start with the basics, or ask for a second pair of eyes
Two free ways to see where your business stands, written in plain English.
Need an independent view of your current security posture?
Share the services in scope, the reason for the review and any audit or change deadline. The first conversation will focus on the assessment boundary, available evidence and the decisions the work needs to support.