Why it's worth 10 minutes
Find your gaps before an attacker — or an application — does.
AI has made phishing, impersonation, and payment fraud faster, cheaper, and far more convincing. The basics matter more than ever.
Know your real security posture
Answer plain-language questions about the controls that matter most against today's threats: MFA, backups, endpoint protection, email security, patching, and staff training. You'll see what's in place, what's partial, and what's missing.
See what insurers typically ask
Cyber insurance applications commonly ask about these same controls. If coverage is on your radar, you'll see how your answers would likely read before you fill one out. If it's not, skip this part. Your security results stand on their own.
Get a plan, not just a score
Your gaps are ranked by impact and explained in plain language, with specific next steps you can act on.
Your report
Your score — and what to do about it.
A plain-English breakdown of every gap — what it means, why insurers typically care, and what to do next.
- A CyberReadiness Score you can hand to a broker or your board
- Every gap explained in plain language
- Next steps ranked by impact
- Optional free pathways to quotes or remediation help
Priority fixes
Enforce MFA on emailHigh impact
Test your backupsHigh impact
Written incident response planMedium
FAQ
Questions, Answered
- It's a single 0–100 score that shows how ready your business is for today's cyber threats. It's made up of two components: Cyber Posture, which reflects the security controls you have in place, and Insurance Readiness, which reflects how you'd measure up on the questions insurers commonly ask. Your report shows the headline score, both components, and where the gaps are.
- The assessment measures three scored pillars: Security controls (60%), Email & domain security (20%), and Phishing & impersonation resilience (20%). Answers contribute to the relevant pillar and roll up to one CyberReadiness Score. Optional insurance and AI usage checks are separate and do not change that score.
- The questions are written in plain language, and the website scan pre-fills what it can before you start. You can save and come back later. If you're unsure about an answer, that's useful information in itself — it usually points to something worth confirming with whoever manages your systems.
- Two things. First, attackers are using AI to make phishing emails, fake invoices, and voice or video impersonation far more convincing. Second, staff are increasingly pasting company or customer data into AI tools without a policy on what's allowed. The controls that protect you — MFA, verification steps for payments, staff awareness, and clear rules for data handling — are the same ones the assessment checks.
- The threats aren't new, but they're faster and more targeted. AI lets attackers personalize scams at scale, mimic a real colleague's writing or voice, and find weak spots quickly. That raises the value of basics done well: strong authentication everywhere, backups you've actually tested, a way to verify unusual payment requests, and people who know what to look for.
- You get a report with your CyberReadiness Score, both components, a breakdown by area, and prioritized next steps. From there you can act on the gaps yourself, ask for help with remediation, or request an insurance quote — each is optional, and the report is yours either way.
- Your answers are used to generate your report and are stored securely. They are not sold or shared for marketing. If you choose to request a quote or remediation help, we tell you exactly who receives your information before anything is sent. Our privacy policy has the full details.
- At least once a year, and whenever something significant changes — new systems, new staff, a move to new software, a security incident, or an upcoming policy renewal. Reassessing takes about 10 minutes, and your history is kept so you can see progress over time.
- The two overlap heavily, but they aren't the same. Being secure means your controls actually protect you. Being insurance-ready means you can answer an insurer's questions accurately and favorably, such as whether MFA covers all remote access and admin accounts, whether a backup copy is kept offline, and whether endpoints are centrally monitored. A business can be reasonably secure and still fall short on an application. That happens when a control is only partial, such as MFA on email but not on privileged accounts, or with questions that aren't purely technical, like incident history or how you verify payment-change requests. Many applications state that inaccurate answers can affect or void coverage, so knowing your honest answers ahead of time matters.
Start a couple of months out so you have time to close gaps, not just report them.
- Pull last year's application and note what's changed: people, systems, vendors, revenue.
- Confirm your MFA coverage across email, remote access, admin accounts, and backups.
- Document your backups: how often they run, whether a copy is offline or immutable, and when you last tested a restore.
- List your tools by name. Applications commonly ask which endpoint, email security, and MFA products you use.
- Gather your history: incidents, outages, or fraud attempts in the past three years, and your wire and payment verification process.
- Answer precisely. If an answer is "no," explain any compensating controls rather than leaving it bare.
Running the assessment first shows you which of these need work while there's still time.
Know your score before you apply.
Ten minutes now beats a surprise at renewal — or after an incident.
Start the free assessment
FREE · ~10 MINUTES