Cybersecurity assessment
Cybersecurity Exposure Assessment
Understand your organisation’s external cyber exposure and decide what to address first.
EnquireIllustrative example
Customers are asking how your public-facing systems are protected.
A constructed scenario, not a client engagement or a promised result.
A business needs a current view of its website, email configuration and customer portal before answering a customer security questionnaire. The owners need to understand what the agreed public hosts expose and which questions require deeper testing.
- The decision
- Which observations need action, what evidence can the business provide and where is a deeper assessment needed?
- How the advice helps
- Review the authorised targets and methods, validate material observations and connect each priority to dated evidence, a responsible owner and a next verification.
- The business benefit to test
- Direct attention towards observed issues and unresolved questions, rather than treating every automated alert as an established weakness.
- What the example does not establish
- A publicly reachable service is not automatically vulnerable. This bounded review cannot establish that the system is secure or verify its internal controls.
What happens after the review
Risk reduction depends on the actions your organisation takes and the evidence used to verify them. The review records coverage, confidence and unanswered questions. Your technical team or chosen provider carries out remediation.
The decision
Which observed exposures require action, what remains unverified and who should act?
Who it is for
Business leaders, security leads and technology owners responsible for publicly reachable systems.
When it helps
A customer security review, new portal, acquisition or change to public-facing systems needs a clearer exposure baseline.
What the scope covers
A bounded cybersecurity review of one legal entity, one primary domain and up to five agreed public hosts. It can be commissioned independently of an AI project. Authorised Domain Name System (DNS), email, Transport Layer Security (TLS), ports 80/443 and bounded public-page checks only. Broader security architecture belongs within Enterprise Architecture. AI-specific security and impact questions are scoped within the relevant AI capability.
What we need from you
- Written authority from the appropriate asset owner for the exact targets and methods
- Agreed asset inventory, exclusions, collection window and stop conditions
- Business context and a named technical contact
Outside this engagement
Exploitation, a full penetration test, authenticated or internal-system testing, assurance of internal controls, certification and proof that a system is secure. The Institute does not carry out remediation.
Agree the work before it begins.
We confirm the fee, VAT treatment, delivery window, reviewer, client responsibilities and acceptance criteria in writing. Small assessments are paid upfront. Larger engagements use agreed payment stages.
Commencement depends on the agreed payment or credit arrangement, required inputs, permissions and confirmed capacity. Where existing research is relevant, we verify and tailor it to your engagement.
A sensible next step
A prioritised brief for your team or chosen remediation partner, with independent advice on the evidence needed to close the findings.
Enquire