How exposed is your business, really?

Check every item that's true today for your business. Honest answers give you a useful result.

1. Is multi-factor authentication (MFA) enforced for every user on email and remote access? A phished or reused password is far less dangerous when a second factor is required.
2. Do you run modern endpoint detection and response (EDR), not just consumer antivirus? Signature antivirus misses the post-exploitation behavior that EDR is built to catch.
3. Do you have backups that are tested by actually restoring them, on a schedule? An untested backup is a hope. A restore you have verified is a plan.
4. Is at least one backup copy isolated where ransomware on your network cannot reach it? Backups reachable from an infected machine get encrypted along with everything else.
5. Are operating-system and software updates applied on a managed, timely schedule? Most exploited vulnerabilities have patches that were available for months.
6. Do you have email filtering that catches phishing and malicious attachments? Email is still the number-one way small businesses get breached.
7. Does your team get security awareness training or simulated phishing tests? A trained team is the difference between a click and a breach.
8. Do your staff work as standard users, without local admin rights on their machines? Standard-user accounts dramatically limit what malware can do if it lands.
9. Does your team use a password manager so every account has a unique password? Unique passwords keep a single leak from cascading into account takeovers.
10. Do you have a process that disables accounts the same day someone leaves? Forgotten, still-active accounts are a wide-open door, especially without MFA.
11. Are laptops and mobile devices encrypted (BitLocker, FileVault) and verified? A lost-but-encrypted laptop is an inconvenience, not a data breach.
12. Do you have a managed business firewall, not just the box your ISP provided? A managed firewall lets you segment, monitor, and control what reaches your network.
13. Do you have a written plan for what to do in the first hour of a security incident? Decisions made fast and in order shrink the damage; improvising grows it.