The most valuable part of a security assessment is not the report. That sounds odd coming from a firm that sells security assessments. But an honest answer to the question "What does a security assessment deliver?" has to start with the uncomfortable part: most assessment reports get read exactly once, at the handover. After that they sit in a folder nobody opens again.
Why most reports end up in a drawer
A picture we keep encountering in conversations with SMEs: when we ask "Have you ever had your security reviewed?", the answer is yes, and someone pulls out a document from two or three years ago. Neatly structured, logo on every page, an action catalogue at the back. When we ask which of the actions were implemented, the room goes quiet. Usually it was one or two items IT had planned anyway. The rest still sits exactly where it sat back then: in the report.
The process is almost always the same. A provider spends two weeks reviewing systems, processes and configurations. Then comes a document with sixty or eighty findings, sorted by traffic-light colours. The handover presentation takes an hour, everyone nods, and the meeting ends with "we'll look into it".
And then what happens to lists like that in full calendars happens. IT has long known half of the items. For the other half there is no budget, no time, or no decision on who takes care of it. After six months the document is technically outdated because the environment has moved on. The assessment was formally a success. It changed nothing.
The fault does not lie with the people who receive the report. It lies with the product. A pile of findings is information, not a basis for decisions. And you already had most of the information: almost every IT team suspects that the backups have never been tested under real conditions and that more people have admin rights than necessary. What is missing is an order of priority, an owner per item and a decision on what deliberately stays open.
That is what you should measure the value against, not the page count.
Three things an assessment has to deliver
In our view, a useful assessment delivers three things, and all three are decision tools.
A short list with reasoning
A useful assessment condenses the eighty possible findings into the five to ten items that make the difference, prioritized by what threatens your business, not by what the scanner reports loudest. A technically critical finding on an isolated legacy system with no outside access is less urgent than a medium one on the system your order processing depends on.
This translation from technical to business language is the real work. It is also the core of the difference between a security assessment and a penetration test: the pentest shows you where someone gets in. The assessment tells you what that means for your business and what comes first. Both have their place, but only one of them answers the question of where your next franc should go.
A cut list
The point that surprises many: a good assessment finds the surplus alongside the gaps. Two tools doing the same job, neither of them fully configured. Licences nobody has used since the last project ended. Measures that reassure an auditor and protect nobody else.
In our experience, what you can cut often funds a fair share of what you need to add. That is why the question "What can we drop?" belongs in every assessment, not just "What are we missing?". We have described separately how to consolidate security tools without losing coverage.
A simple test: if all that comes out of an assessment is a shopping list, the provider either did not look closely, or he earns a share of the shopping list.
Language for the budget conversation
The IT manager or CIO wearing the security hat in an SME usually knows fairly precisely what should be done. What he lacks is a document that gets it through: here is where we stand. These are the three biggest risks, in business language. This is what fixing them costs, and this is what is at stake if we leave them.
A good management summary is therefore not a courtesy page at the front of the PDF. It is the tool that turns a finding into a budget decision. If management approves a priority list after the presentation instead of saying "we'll look into it", the assessment has done its job. What an exercise like this should cost in the first place is something we have written down openly here.
The 90 days afterwards
Whether a security assessment achieved anything is not something you see on handover day. You see it about a quarter later, in three questions. Hardly any provider talks about this part, because it comes after the final invoice.
Is there a name next to each of the top items? Not "IT", but a person who owns the item and has a date for it. That sounds banal, but it is the most reliable early indicator: an item without an owner does not move, however red it was marked in the report.
Have the first measures been implemented? Not all of them, that is unrealistic. But the two or three you decided were urgent.
And are the risks you deliberately do not fix recorded as a decision? This is the most underrated point. An accepted risk with reasoning in the minutes is a legitimate outcome. Perhaps the fix costs more than the possible damage, perhaps a planned migration solves the problem anyway. A finding that stays open because nobody ever decided, on the other hand, is not an accepted risk. It is an unanswered letter.
If you can answer these three questions with yes after a quarter, the assessment was worth its money, fairly independently of how thick the report was. This is why we built implementation support for the most critical measures and a follow-up check after 90 days into our security assessment as a fixed component. The reason is sober: without this part, an assessment produces exactly what we described above, namely a PDF.
What an assessment does not deliver
An honest answer includes the other side, because this is where some providers sell expectations no assessment can meet.
An assessment does not give you a guarantee. It is a snapshot with a reasoned evaluation, not insurance against the next incident. Anyone who promises you after two weeks of review that nothing can happen anymore is selling you a feeling, not a result.
It also does not give you a number you can rely on. A maturity level of 2.7 or a score of 68 out of 100 looks precise but does not answer the question "Are we secure?". We have taken apart why that single number does not exist in a separate article. A rating is useful as a reference point against next year, not as a school report.
And it does not replace operations. An assessment establishes that nobody looks at the alerts or that patches are left undone. Someone still has to look and patch afterwards, every week, not once. The review shows you the gap in operations; it does not fill it.
Anyone selling you an assessment as an end point is selling you too much. It is a starting point with a direction. That is less glamorous, but it is what you can buy.
Four questions to ask before you sign
Whether you are buying paper or decisions is something you can tell before the engagement. Four questions to the provider are enough.
- Show me an anonymized sample report. Does it enumerate findings, or does it argue an order of priority? Ten prioritized items with reasoning beat eighty traffic-light colours.
- What do you prioritize by? If the answer is "by CVSS score", the scanner is prioritizing, not your business. The right answer contains words like business process, exposure and damage potential.
- What happens after the handover? A handover meeting and a final invoice? Or owners, implementation and a follow-up check? This is where paper separates from effect.
- Do you also find what we can cut? If the outcome can only contain new things, half the analysis is missing. In an SME especially, the cut list is often the quickest win.
A provider with clear answers to these four questions will probably deliver something useful. One who dodges them will deliver a document. The ten minutes for this conversation are the best investment of the whole exercise.
The question before you sign
A security assessment delivers exactly as much as the decisions it triggers. A reasoned order of priority instead of a heap of findings, a cut list instead of a shopping list, a budget decision instead of yet another folder. None of it is spectacular, and all of it changes more than the most impressive PDF.
If you are evaluating an assessment right now, or have one in a folder that never led to decisions, and want to know what this could look like for you: an initial conversation costs nothing and commits you to nothing.
And if your company has had an assessment done before, out of curiosity: what became of the report?
