GuideSecurity · 6 min
What security gaps do we have, and do we need an assessment to find them?
Start with three questions: what you run, who watches it, and what an attacker would try first. An assessment proves the answers, and the plan closes the gaps.
The Clectiv team ·
You can name some of your gaps today, without paying anyone. Three questions do it. An assessment then tests your answers and puts what it finds in order, so you close the risky gaps first.
What does a security assessment actually cover?#
Start with three questions: what you run, who watches it, and what an attacker would try first. Your answers are your gaps in rough form. An assessment tests them and finds what you missed.
"Assessment" is a loose word, and each kind tests something different.
| Kind | What it does |
|---|---|
| Vulnerability scan | Software checks your systems for known weaknesses, like missing updates. |
| Penetration test (pen test) | People, with your permission, try to break in the way an attacker would. |
| Outside-in check | A look at everything of yours that's visible from the internet, which is what an attacker sees first. |
| Compliance assessment | Your controls compared with a standard your auditor or insurer uses, like HIPAA or CMMC. |
| vCISO review | A virtual chief information security officer, a part-time security leader, reviews your whole program. |
Each one answers a different question. A scan shows what's out of date, a pen test shows whether anyone could use it, and a compliance assessment shows whether you'd pass an audit.
Which of them you need depends on your three answers, and the plan sets that.
LevelBlue, Thrive and Cipher Security all sell pen testing. Thrive and Cipher Security add compliance and advisory work, and BlueVoyant watches what's exposed to the internet. Those are some of our security providers for this, and Clectiv AI runs the process with them for you: start a project.
Before you call anyone#
Take your three answers to Clectiv AI before you ask anyone to assess you. Clectiv AI runs the process from there: the providers that fit get it as a bid, they compete for it, and you choose. Book an assessor first and its report can come with its own fix attached.
How do we read the results?#
Read the report by exposure, not by count. A long list of findings isn't a bad sign. What matters is which ones an attacker could reach, and what they'd reach next.
Ask three things of every finding:
- Can someone reach it from the internet?
- Does it touch something you can't lose, like customer data, money or the systems that keep you running?
- Is anyone watching that system tonight?
A severity rating describes the flaw, not your situation. A high rating on a system nothing can reach can wait. A medium rating on your login page can't.
Ask what was tested and what wasn't. A clean report on a narrow scope tells you little. Check that your cloud accounts, remote access, your suppliers' connections and the AI tools your people use were in it.
Put the findings next to your answers with Clectiv AI, and the plan ranks them against what you run and who watches it.
Here's the thing: this has been done before. Clectiv AI runs the process we've run for buyers like you, so you start where they ended up. From there the plan goes straight to these providers, for the best pricing, terms and contract we can get.
What happens to the gaps after the report?#
Every gap becomes a line in the plan: the fix, who owns it, and by when. Clectiv AI's plan keeps them in one list, with the ones that cut the most risk first.
Gaps fall into three kinds:
- Fixes your own team can make, like switching on multifactor authentication (the second check, such as a code on your phone) or removing old accounts.
- Fixes that need a provider, like someone to watch your systems overnight.
- Paperwork, like the policies and proof an auditor or insurer asks for.
The providers that fit bid on the second kind, all against the same list. Then you test again to prove each fix worked. One hint: ask every assessor whether a retest is included.
Some gaps you'll choose to live with for now. Keep each one on the list, with a date to look at it again.
Don't let the report sit. An audit or a renewal date turns an open gap into a bigger problem, so close the ones that decide those first.
Common questions#
Do we need a penetration test, or is a scan enough?#
How much does a security assessment cost?#
What should we have ready before an assessment?#
Can the provider that finds the gaps also fix them?#
How often should we assess our security?#
How does Clectiv AI get this done?#
It starts in Clectiv AI. Tell it what you run and who watches it today. It scopes the assessment with you and writes your plan: what gets tested, against what, and who fixes what it finds.
Then the Clectiv team takes your plan to the assessment and managed-security providers that fit, all at once, through our partner network of 620+ providers. They put in bids and compete for the work, the team pushes on terms with each, and you choose the winner.
Plenty of companies have stood where you are. Clectiv AI runs the process we've run for companies like yours, so you start where they finished. The plan goes straight to the providers that fit for the best pricing, terms and contract we can get on each.
It stays free to you, and it takes days, not months. The security page has everything we cover in security.
Is an insurance renewal the trigger? Read what a cyber insurance renewal wants.
Sources and method. No prices appear in this guide. The kinds of assessment describe how they're commonly sold, not any one provider's terms. Provider names are examples of who sells assessments and advisory work, from Clectiv's provider directory, not a ranking.