Cybersecurity Risk Assessment Services: an Engineer-Led Review of Your Exposure
A security problem you can name is the easy kind. The harder one is a set of assumptions nobody has ever tested. A NetSys assessment tests them: what's exposed to the internet, who can reach what inside, whether the backups actually restore, and how your staff behave when a convincing email arrives. What you get back is a prioritized findings list, an executive summary your leadership can act on, and a remediation plan. For configuration and log evidence, NetSys engineers use Claude to help read authorized configurations, logs and tool findings, then validate every finding themselves before it reaches the report. The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you.
The short answer
Cybersecurity risk assessment services identify exposure, explain the business impact and prioritize work to reduce it. NetSys scopes the review around your question: external attack surface, Microsoft 365 security, system configuration or broader business risk. The deliverable records evidence, affected assets, severity, an action owner and a verification step; the agreed access and testing boundaries determine what can be concluded.
An assessment is a common way a NetSys relationship starts. Somebody wants to know where they stand before signing anything, so an engineer goes and looks, writes it down, and hands it over. What happens after that is genuinely their call.
We have spent 28+ years in business working with importers, medical practices, law firms, and financial firms, and the scope of the exercise changes with each of them. The output doesn't. You end up with a list you can act on, in priority order, in language your leadership actually understands.
This is the broader assessment practice. The free remote external penetration test has a limited scope based on available information. Internal configuration reviews, restore tests and compliance assessments are separate engagements. Reviewing the security of an AI rollout itself, such as Claude or ChatGPT identity, connectors and data settings, is a different service: see the AI security assessment.
A Scan Is Output. An Assessment Is Judgment.
Any tool can produce a list of missing patches and open ports. That list is close to worthless until somebody knows which server runs your ERP, which mailbox the bookkeeper shares, and what happens on a Friday afternoon when the warehouse is shipping. Our engineers run the tooling, then spend the real hours on interpretation: which findings are genuinely reachable from outside, which are theoretical, which are load-bearing for the business, and which cheap fix removes three of them at once. That's why what you get back is short and ordered rather than long and alphabetical, and why every finding carries an effort estimate next to its severity. A risk you can't schedule isn't actionable.
What We Assess, and What You Get Back
External Attack Surface
What an attacker can see and reach before they have any credentials at all.
- Internet-facing services, remote access endpoints, and open ports
- Firewall, VPN, and edge device configuration and firmware state
- Exposed administrative interfaces and forgotten legacy hosts
- Domain, DNS, and email authentication records (SPF, DKIM, DMARC)
- Company credentials already circulating from third-party breaches
Identity & Microsoft 365 Posture
A working login opens more doors than an exploit does. Identity is where we spend the most time.
- Multi-factor authentication coverage, including the accounts that quietly skipped it
- Conditional access policies, legacy authentication, and admin role assignment
- Mailbox forwarding rules, delegate access, and third-party OAuth app consents
- Former employees, service accounts, and shared logins that still work
- Tenant audit logging and alerting: whether anything would be noticed
Security Configuration Review
What does a security configuration review cover? Authorized configurations, logs and tool findings, read with Claude's help and validated by an engineer.
- Evidence scope agreed first: Microsoft 365 and Entra ID exports, Conditional Access and sign-in logs, firewall and endpoint configurations, and tool output such as Maester and CISA ScubaGear reports
- Claude-assisted interpretation: findings grouped, explained and mapped to the baseline they fail, with the engineer validating each one against the live setting
- Exceptions and false positives recorded with a reason, so the same item does not reappear in every review
- Prioritized remediation with named owners and approvals, then a retest that shows the before and after evidence
- Report limitations stated plainly: which controls could not be verified, and why
Endpoint & Patch State
Every laptop is a way in. We inventory what's actually deployed, not what the asset spreadsheet claims.
- Devices with no endpoint detection agent, or an agent that stopped reporting weeks ago
- Operating system and third-party patch levels, including unsupported versions still in service
- Local administrator rights and credential reuse across machines
- Disk encryption and lock-screen policy on anything that leaves the building
- Unmanaged personal devices touching company mail and files
Backup Recoverability
A backup nobody has restored is a hypothesis. We test it instead of reading the console.
- Whether backups are genuinely offline or immutable, or reachable with the same credentials as production
- Timed restore tests against real data: files, mailboxes, and a full system
- Coverage gaps: Microsoft 365 data, line-of-business databases, cloud file shares
- Recovery time and recovery point measured against what the business can actually absorb
- Who holds the keys, and whether recovery depends on one person answering the phone
Network Segmentation & Internal Access
The real question isn't whether someone gets in. It's how far they get afterward.
- Flat networks where a warehouse scanner can reach the accounting server
- Guest Wi-Fi, cameras, IoT, and building systems sharing production VLANs
- File share and folder permissions: who can open payroll, HR, and client matter files
- Lateral movement paths from a single compromised workstation
- Vendor and remote-support access routes into the environment
User Susceptibility
The control that is a frequent weak point is a person under time pressure.
- Authorized phishing simulation against a real employee population
- Wire-transfer and vendor-bank-change procedures: the process, not just the mail filter
- Who has been trained, when, and whether behavior changed afterward
- How staff report something suspicious, and whether anyone is reading those reports
Sample Deliverables
Three artifacts, written for three different people in your building.
- Prioritized findings list: each item states what we found, how we found it, what it exposes, a severity, and an honest effort estimate (an afternoon, a weekend, or a project)
- Executive summary: a plain-English read for an owner or partner who doesn't manage IT, covering the handful of findings that genuinely matter and what they put at risk
- Remediation plan: the fixes in the order we'd do them, each marked with its owner (your staff, your existing vendor, or us)
- Raw tool output attached as an appendix, so nothing is hidden, but the appendix is not the report
- A walkthrough with the engineer who did the work, so you can argue with the conclusions
- Everything is yours to keep, including if you hand it to another provider tomorrow
How It Starts and What Happens Next
The free external penetration test is the front door. Nothing after it is automatic.
- The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you.
- If the external findings raise deeper questions, we agree a separate scope for a broader assessment
- Findings that line up with carrier questions feed straight into cyber-insurance readiness work
- Businesses that want the program owned, budgeted, and reported over time move to a vCISO engagement
- Remediation can go to your team, your current provider, or us, and we'll say plainly if something is outside our lane
Where We Assess
On-site visits across our service regions; remote assessment work anywhere.
- On-site: New York City, Nassau and western Suffolk, Westchester and Rockland
- On-site: North and Central Jersey, the northern Jersey Shore and lower Fairfield County, CT
- 50 to 60 miles out: remote-first, and we confirm drive time before scheduling any on-site visit
- Beyond 60 miles: remote and cloud-based support only, with hardware shipped pre-configured
- Remote assessment of cloud, identity, and endpoint posture wherever your systems live
Why Businesses Choose NetSys for Security Assessments
Fifteen minutes with a NetSys engineer, not a salesperson, and you will know where your security assessments stands and what it would take to fix it. Call 845-203-3914 or request a call to discuss the scope and next steps.
Who does the work: meet the NetSys team on our About page.
- An engineer interprets the findings; you're not handed a scanner export and wished luck
- The entry point is a free external penetration test, and the findings are yours either way
- Engineers who have worked real environments for 28+ years: importers, medical practices, law firms and financial firms
- A 100% ransomware recovery record standing behind everything we tell you about your backups
- Findings ranked by real-world risk and remediation effort, not by vulnerability count
- Claude-assisted analysis of configuration, log and tool evidence, with an engineer validating every finding before it is reported
- Confidentiality first: financial clients stay unnamed, and so do you
- Month to month, like every NetSys agreement, if you decide to keep working with us
Measured results from our case studies
Which security testing page you need
This page covers a broad review of exposure and business risk. If your question is narrower, one of these tests answers it more directly.
| Page | Use it when |
|---|---|
| This page: Cybersecurity risk assessment | You need a broader review of exposure and business risk, with findings ranked and each fix given an owner. |
| Penetration testing | You want proof of what an attacker could reach from the internet, starting with the free external network test. |
| Web application penetration testing | The target is your own software: its code, logins and APIs, tested from source in an isolated sandbox. |
| Vulnerability management | You need scanning and a weekly fix-and-verify loop that runs all year, not a point-in-time test. |
Related pages: Penetration testing · Web application penetration testing · Vulnerability management.
Choose the assessment by the question
A narrow test can be useful without being a review of the whole business.
| Business question | Scope to discuss | Evidence expected |
|---|---|---|
| What is exposed to the internet? | Authorized external exposure or penetration testing | Affected asset, reproducible finding and agreed retest |
| Is our Microsoft 365 tenant configured safely? | Identity, admin access, sharing and relevant tenant controls | Configuration evidence, impact and remediation priorities |
| Are important systems configured appropriately? | Named devices, applications and network components | Observed configuration, exceptions and change recommendations |
| Which risks should leadership fund first? | Systems, data flows, business impact and control review | Prioritized risk register with accountable decisions |
A finding should remain traceable through retesting
Illustrative finding lifecycle, not a report of an actual client weakness.
| Stage | Record |
|---|---|
| Finding | A former role still has access to a sensitive library; identify the library and evidence date |
| Decision | The data owner confirms the intended group and approves removal of obsolete access |
| Remediation | The assigned administrator changes the group or permission and records the change |
| Retest | Test an authorized and an unauthorized account; record the result and any exception |
| Closure | Owner accepts the result or retains the risk with a reason and next review date |
Authorization and review are part of the scope
The review must produce evidence you can act on without confusing tool output with a verified finding.
- Agree the systems, permitted methods, access, maintenance constraints and contact route before testing.
- Engineers validate findings and the recommended actions; AI-assisted analysis does not approve changes or establish a result by itself.
- State what could not be tested, how that limits the conclusion and what additional access or work would resolve it.
- Agree whether remediation and retesting are included or separate deliverables.
What a finding looks like in the report
An illustration of the report format, not a finding from a client's report. Every item in the prioritized findings list carries the same fields:
| Field | Example entry |
|---|---|
| Finding | Former employees' accounts can still sign in to Microsoft 365 |
| How we found it | Account and sign-in review in Microsoft 365 and Entra ID, checked against the current staff list |
| What it exposes | Mail and files reachable with a password nobody monitors, on accounts nobody reviews |
| Severity | High |
| Effort | An afternoon |
| Who should fix it | Your own staff; the steps are written so your current provider could act on them instead |
Findings are ordered by severity and effort together. The same report carries an executive summary for leadership and a remediation plan in working order; raw tool output sits in an appendix.
How a risk assessment runs
The same sequence for a one-area review or a six-area assessment. Only the scope changes:
- Scoping call: the question you need answered, the systems and sites in scope, and the deliverables, agreed in writing.
- Authorization and access: written approval for any active testing, read-only accounts where they are enough, and stop conditions for production systems.
- Discovery and testing: scans and configuration review, plus restore tests or a phishing simulation only where the scope includes them.
- Analysis: an engineer checks which findings are reachable and which matter to how the business runs, then ranks them by risk and effort.
- Report and walkthrough: the findings list, executive summary and remediation plan, walked through with the engineer who did the work.
- Next steps, your choice: fix it yourself, hand it to your current provider, or scope the work with us.
Timing depends on the scope and is agreed before work starts. Nothing in this sequence requires you to become a managed client.
How Claude-assisted analysis fits a security configuration review
NetSys participates in Anthropic's Cyber Verification Program with Defense Access. Anthropic's terms for that program cover an organization's own systems and require separate approval before the access is used in services involving customer systems, so a client review uses the Claude product named in its scope agreement. In a configuration review the engineer collects the evidence, Claude helps read it, and the engineer decides what is true:
| Step | What Claude is asked to do | What the engineer does |
|---|---|---|
| Evidence collection | Nothing. Claude is not connected to your systems; it works on evidence the engineer has already exported | Agrees the scope, exports configurations, logs and tool reports under read-only access, reduces them to what the question needs and records what was not available |
| Interpretation | Groups findings, explains what a setting or log pattern means, maps each item to the baseline or control it fails and drafts questions to check | Checks each explanation against the live setting and discards anything the evidence does not support |
| Prioritization | Proposes a draft order from reachability, exploit availability and the systems behind each finding | Sets the final severity and effort, knowing which server runs the ERP and which mailbox approves payments |
| Remediation | Drafts change steps and rollback notes for review | Writes the plan that goes to your team, your provider or NetSys, with owners and approvals |
| Retest | Compares the before and after evidence and flags what still differs | Reruns the checks, confirms closure and signs the evidence into the report |
Claude output is never a finding on its own. An engineer confirms every item before it enters the report, and the report says where the evidence ended.
What data goes to Claude during a review, and for how long
The scope agreement states the product, the data path, the retention terms and the human review before any evidence moves:
- Product: the Claude product and model class used for your review are named in the scope agreement. Anthropic's commercial products do not use inputs or outputs for training by default, as of October 2026.
- Data path: an engineer uploads reduced evidence (configuration exports, log extracts, tool reports) from a NetSys account. No connector into your tenant or devices is used for review evidence, and secrets and personal data are removed where the question does not need them.
- Retention: as of October 2026, Anthropic deletes API inputs and outputs within 30 days of receipt unless a different agreement applies. Models accessed under the Cyber Verification Program, which needs Anthropic's separate approval before it is used on customer systems, require data retention for Anthropic's misuse monitoring (30 days for Mythos-class models), so we do not promise zero data retention on that route. Content flagged under Anthropic's policies can be kept longer.
- Human review: the engineer who collected the evidence checks every Claude output. Nothing enters the findings list, the executive summary or the remediation plan without that check.
- Your record: the report appendix lists the exports and extracts that were reviewed, so you know what left your environment and when.
We do not promise that all data stays on your systems or that every route has zero retention. We name the product, the path and the terms, and you approve the evidence set before it moves.
Where we deliver Security Assessments
Security Assessments in Stamford, CT · Security Assessments in Nassau County, NY · Security Assessments in Greenwich, CT · Security Assessments in Brooklyn, NY · Security Assessments in Pennsylvania · Security Assessments in Norwalk, CT. We also support clients remotely wherever their systems run. See all locations and service areas.
Security Assessments FAQs
What is the difference between a risk assessment and a penetration test?
A penetration test evaluates a defined technical attack scope using authorized methods. A risk assessment can also consider business impact, data flows, operating practices and the controls around them. The proposal should identify which question is being answered and which evidence will be available; the labels alone do not define the work.
What is a cybersecurity risk assessment?
A cybersecurity risk assessment is a structured look at what could go wrong in a business's IT, how likely each problem is and how much harm it would do, so the fixes can be put in order. NIST SP 800-30 defines risk as a function of the likelihood of a threat event and its potential adverse impact. In practice that means reviewing each area in scope, recording what is exposed, scoring each finding and turning the results into a ranked remediation plan.
Is a cybersecurity risk assessment the same as a cybersecurity audit?
No. A cybersecurity risk assessment asks what could go wrong: it finds weaknesses, judges how likely and damaging each one is, and ranks the fixes. A cybersecurity audit asks whether you meet a defined standard: it tests controls against a named framework, policy or contract and records the evidence. Buyers often use 'IT security audit' for either, so agree which you need first. NetSys scopes risk assessments and remediation; a formal attestation needs a separate qualified provider.
What does a Microsoft 365 security assessment cover?
A tenant-focused scope can review administrator roles, MFA and sign-in policies, external sharing, application consent, email protection, audit visibility and backup or retention configuration. Access and licensing determine what can be examined. The output should separate confirmed findings from controls that could not be verified, assign priorities and explain the remediation options. It does not imply an internal network test or a compliance certification.
What is a security configuration review?
A security configuration review checks how systems are actually set up against a baseline: Microsoft 365 and Entra ID settings, Conditional Access, firewall rules, endpoint policies and logging. The evidence is read-only exports, logs and tool findings rather than active testing. NetSys engineers use Claude to help interpret that evidence, validate each finding against the live setting, record exceptions and false positives, and deliver a remediation plan with owners, approvals and retest evidence. It is the narrower, evidence-first version of the risk assessment on this page, and the Microsoft 365 security service runs it for a tenant.
What is a cloud security assessment or a security posture assessment?
A cloud security assessment reviews a cloud tenant or subscription, such as Microsoft 365 or Azure, for identity, sharing, logging and configuration weaknesses. A security posture assessment applies the same idea across the whole organization, usually measured against a framework such as the CIS Controls or the NIST Cybersecurity Framework. Both produce ranked findings and a remediation plan. NetSys scopes them by area: the Microsoft 365 security page covers the tenant audit and hardening, and the vulnerability management page covers the ongoing scanning and patching loop.
What is an AI-assisted security audit, and how do you use Claude in an assessment?
In an AI-assisted security audit a model helps engineers read large volumes of configuration, log and scanner evidence: grouping findings, explaining what a setting or log pattern means, mapping items to the control they fail and drafting remediation steps. NetSys uses Claude this way for authorized evidence only. An engineer collects the evidence, decides what is uploaded, validates every Claude output against the live system and writes the report. In a review Claude works on exported evidence, not on a connection into your systems, and no AI output is reported as a confirmed finding without that validation.
Do you use Claude Mythos for security assessments?
Only where Anthropic has approved it for that work. As of October 2026, Mythos-class models are available only to organizations verified through Anthropic's programs, and the Cyber Verification Program's Defense Access tier covers defensive work such as security operations center and incident response tasks and vulnerability analysis and validation. NetSys participates with Defense Access, and Anthropic's terms require separate approval before that access is used in services involving customer systems. Anthropic says its generally available models remain usable for triaging security alerts, code review and finding vulnerabilities in owned source code. NetSys does not sell model access; the service is the review and the verified remediation. The scope agreement names the product used for your evidence, and the model's role is interpretation, not judgment: an engineer decides what is a finding.
What data do you share with Claude, and how long is it kept?
Only the evidence the scope names, reduced to what the question needs: configuration exports, log extracts and tool reports, uploaded by an engineer from a NetSys account. As of October 2026, Anthropic's commercial terms do not use inputs or outputs for training by default, API inputs and outputs are deleted within 30 days of receipt unless a different agreement applies, and models accessed under the Cyber Verification Program require data retention for Anthropic's misuse monitoring (30 days for Mythos-class models), so we do not promise zero data retention on that route. The report appendix lists what was reviewed. We do not promise that every route has zero retention or that all data stays on your systems.
How do you validate that a remediation worked?
By rerunning the check that produced the finding and keeping both results. For a configuration item that means a fresh export or tool run showing the new setting; for a vulnerability it means a rescan that no longer reports it; for a backup it means another timed restore. The retest evidence goes in the report next to the original finding, with the date and who made the change. Items that cannot be fixed yet are recorded as exceptions with a mitigation, an owner and a review date. The vulnerability management service runs that loop every week.
What is the difference between a security assessment and a vulnerability scan?
A scan is automated output: a tool lists missing patches, open ports, and known vulnerabilities. An assessment is an engineer reading that output against how your business actually runs: which findings are genuinely reachable, which one sits on the server your ERP depends on, and which single change closes several at once. We run scans as part of an assessment. We don't hand you the scan and call it a report.
Can a cybersecurity risk assessment tool replace an assessment?
A tool is a good start, and we run scanners as part of every assessment. What a tool cannot know is which server runs your ERP, which mailbox approves payments or which finding is reachable from outside, so it cannot put the work in order. Our free seven-question self-assessment is a quick first look; the assessment adds an engineer's judgment and tests such as restores and phishing simulations where the scope includes them.
What does a network security assessment actually examine?
Six areas: your external attack surface, identity and Microsoft 365 posture, endpoint and patch state, backup recoverability, internal network segmentation and permissions, and user susceptibility to phishing and wire fraud. Scope is agreed before we start: some clients want all six, some want the two they're already worried about.
What deliverables do we receive at the end?
Three things. A prioritized findings list, where every item states what we found, how we found it, what it exposes, a severity, and an effort estimate. An executive summary written for an owner or partner who doesn't manage IT. And a remediation plan ordered the way we'd actually do the work, split by who should do each piece. Raw tool output is included as an appendix, and an engineer walks you through all of it. It's yours to keep, including if you hand it to a different provider.
How are findings scored for risk?
Each finding gets a severity built from likelihood and impact. Likelihood rises when a weakness is reachable from the internet, has a working public exploit or is already being exploited; impact rises with the system and data behind it, such as the server your ERP runs on or a mailbox that approves payments. Severity sits next to an effort estimate (an afternoon, a weekend or a project), so the plan puts high-risk, low-effort fixes first.
How is this different from your penetration testing service?
The free assessment is a remote external penetration test, limited to the information available to NetSys and the external scope we agree with you. A broader security assessment can include configuration review, identity posture, restore testing, permissions and segmentation, but those require a separate agreed scope. The external test cannot establish the state of controls it cannot see.
Is the assessment disruptive to our operations?
We agree access, testing methods, production constraints and stop conditions with you before starting. Configuration review may be read-only, while scans, restore exercises or active testing need their own authorization and schedule. Where testing carries operational risk, that risk and the fallback plan belong in the scope; no assessment should promise that every possible test is risk-free.
How do we prepare for a cybersecurity risk assessment?
Have four things ready: the systems and sites you want in scope, a contact who can approve testing and grant read-only access, your current staff and vendor lists, and whatever is driving the work, such as an insurer's application or a client's security questionnaire. Earlier reports help too, so the new one can show what changed. You do not need to fix anything first; the point is to see the environment as it is.
Do we have to become a managed client afterward?
No. The free external penetration test carries no obligation and the findings are yours regardless. Larger assessments are scoped and agreed up front. If you want the fixes handled by your own staff or your current provider, that's a fine outcome; the report is written so somebody else can act on it.
Will the findings help with our cyber insurance application or a client security questionnaire?
Usually, yes. What carriers and enterprise clients ask about (multi-factor authentication coverage, endpoint detection, tested backups, training) is largely what an assessment examines, so you answer from evidence instead of memory. We implement and document controls; coverage and premium decisions stay between you and your carrier.
How often should we reassess?
Environments drift. New staff, a new vendor, another office, a platform change, one exception granted 'temporarily': the picture looks different a year later. An annual revisit is a sensible cadence, and so is timing one ahead of an insurance renewal, an acquisition, or a client security review. Managed clients get much of this continuously through monitoring rather than as a separate exercise.
How much do cybersecurity risk assessment services cost?
NetSys quotes each risk assessment after a scoping call and publishes no rate card. The price moves with the number of areas in scope, the users, devices and sites involved, whether active tests such as restores or a phishing simulation are included, and any on-site work. The remote external penetration test that often comes first is free.
How long does a cybersecurity risk assessment take?
The timeline follows the scope, and we agree it in writing before work starts. A review of one area, such as a Microsoft 365 tenant, takes less time than all six areas with restore tests and a phishing simulation. Access, approvals and change windows often set the pace as much as the testing does.
Sources and technical references
- NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments
- Anthropic: Expanding the Cyber Verification Program (October 6, 2026)
- Anthropic: Claude Mythos, access through verification programs and the 30-day data retention policy
- Anthropic Privacy Center: how long organization data is stored
- Anthropic Privacy Center: commercial data and model training
Guides on this topic
- Compare the external test scope
- Microsoft 365 security work
- Operate detection and response
- NetSys announcement: participation in Anthropic's Cyber Verification Program (October 19, 2026)
- Arrange ongoing Microsoft 365 management
- Focus an assessment on your insurance questionnaire
- Free 7-Question Cybersecurity Self-Assessment
- vCISO Services
- The NetSys Cyber Threat Report
- The 2026 SMB Cybersecurity Checklist (Print This)
- Understanding NIST, ISO 27001, and CIS Controls
- cybersecurity consultant services
- broader IT audit
- Vulnerability assessment tools for a small business
- An IT audit checklist you can work through first
- Claude, Mythos and defensive security: what an assessment includes
- Using Claude to interpret security logs and audit findings
- Vulnerability remediation prioritization and validation
- Securing a Claude or ChatGPT deployment: the other security question
Get findings with an owner and a verification step.
Tell us the business question, systems involved and any customer or insurer deadline. We will define the evidence, testing boundaries and deliverables.