A scored, business-level view of your cyber risk — in two weeks, for a fixed fee
An organization-wide cyber risk assessment for companies that need to answer "how exposed are we, and what should we fix first?" without a six-figure consulting engagement. VGuard Cyber inventories your critical assets, interviews your control owners, reviews your key technical controls and delivers a prioritized risk register, an executive risk report and a 12-month treatment roadmap.
$497
Start my assessment — $497 Talk to us firstWho this is for
- Companies with 10–500 staff that have never had a formal, documented cyber risk assessment
- Leadership teams asked by a board, insurer, bank or key customer to demonstrate risk oversight
- Organizations planning security spend and wanting to prioritize by risk, not by vendor pitch
- Teams preparing for SOC 2, ISO 27001, HIPAA or NIST CSF, where an annual risk assessment is a core requirement
What is assessed
Business context & assets
- Critical processes, data types (customer, financial, regulated) and the systems they depend on
- Where the crown jewels live and who can reach them
Threat & exposure
- Realistic threat scenarios: ransomware, business email compromise, credential theft, vendor compromise, insider misuse
- External attack surface and exposed services
Control effectiveness
- Identity & MFA, endpoint protection, patching, backup & recovery, logging, email security, vendor management, awareness
- Rated against NIST CSF 2.0 and CIS Controls v8 Implementation Group 1–2
Risk scoring & roadmap
- Likelihood × impact scoring, inherent and residual, per scenario
- Prioritized 12-month treatment plan with effort, cost band and owner
How it works
Scope, asset and data inventory, list of control owners, read-only access to key consoles where you choose to grant it.
Control-owner interviews (up to 4), configuration review, external exposure review, scenario analysis and scoring.
Executive walkthrough of the risk report, register and roadmap. Recording and files are yours to keep.
This is an advisory risk assessment. It is not a penetration test, a vulnerability scan alone, or a compliance certification — where useful we map findings to SOC 2, ISO 27001 and HIPAA requirements so the same work supports your audit program.
Deliverables
- Executive Cyber Risk Report (PDF) with an overall risk rating and heat map
- Risk register (spreadsheet) — every scenario scored, with existing controls and residual risk
- Control maturity scorecard against NIST CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover)
- 12-month prioritized treatment roadmap with quick wins for the first 30 days
- One-page board / insurer summary
How this differs from our other assessments
- Cyber Risk Assessment ($497) — whole-organization risk: threats, assets, control effectiveness and a treatment roadmap. Start here if you have never had a formal assessment.
- SOC Readiness Assessment ($497) — narrow and deep on security operations: can you detect and respond to an attack?
- Compliance Consulting Package ($497) — framework-specific gap analysis and audit preparation for SOC 2 / HIPAA / ISO 27001.
Questions
How much of our time does it take?
Typically 4–6 hours across the kickoff, interviews and readout. No agents or tooling need to be installed.
Do you need access to our systems?
Read-only access to your identity provider, endpoint console and cloud/M365 admin center speeds things up, but interview-based assessment is possible if you prefer not to grant access.
Can the roadmap be delivered by your team?
Yes. Roadmap items can be scoped as fixed-fee projects or under a managed plan; there is no obligation.
Is the fee refundable?
Full refund if we have not held the kickoff call within 10 business days of purchase, per our refund policy.