At some point, someone tells you to get a cybersecurity risk assessment. The push comes from your insurer, your board, a client’s procurement team, or your own nagging sense that nobody has ever actually looked. Then you go shopping and discover the term means everything and nothing. A $99 automated scan, a $50,000 penetration test, and a free “audit” from a sales team all wear the same name.
Here is how to tell them apart, what a real assessment includes, and what honest pricing looks like.
In short
- Three different things are sold as assessments. Most businesses need the risk assessment.
- A real one examines people, process and technology across nine areas, and includes interviews.
- Ours is published: $1,500 flat up to 10 users, and $150 per user above that.
- Ask whether the report is yours to keep.
Three Different Things Are Sold as “Assessments”
An automated scan points software at your network and prints what it finds: open ports, missing patches, known vulnerabilities. Scans produce useful raw material at low cost. They also miss everything procedural. A scanner cannot notice that your bookkeeper can be talked into wiring money, that a departed employee still has working credentials, or that your backup has never been restore-tested.
A penetration test pays skilled humans to break in and document how they did it. Pen tests are valuable, and they are usually the wrong first step for a small business. They answer “can a determined attacker get in?” The answer is yes. The question you need answered first is “where are all the ways in, and which do we fix first?”
A risk assessment examines people, processes, and technology together. It weighs findings by likelihood and impact, then produces a prioritized plan a business owner can act on. Most businesses need this one, and quality varies enormously, so it deserves the careful comparison below.
What a Real Cybersecurity Risk Assessment Covers
An assessment that only looks at technology is a scan with a report attached. A real one examines nine areas:
Concretely, that means identity and access, data protection, business continuity, devices, network, applications, policies and response plans, management oversight, and physical security. A real assessment also includes interviews. Whoever pays invoices, whoever onboards staff, and whoever people call when something breaks all know things no scanner can see. The most valuable findings usually live in the contradictions between what the tools report, what the policies say, and what your people describe actually doing.
What a Cybersecurity Risk Assessment Costs
Market rates for a genuine risk assessment run from a few thousand dollars to the low tens of thousands. Price scales with headcount, complexity, and regulation.
Ours is published: $1,500 flat for businesses with 10 or fewer users, and $150 per user above that. A user is anyone who touches your systems, including contractors and part-timers. A 30-person business pays $4,500. That buys thirty days of examination, a written report across all nine areas, a 30/90/180-day action plan, and a briefing presented to your leadership.
Watch for two pricing red flags, in opposite directions. A $500 “comprehensive assessment” is an automated scan wearing a suit, because the labor of interviews and analysis cannot exist at that price. A free assessment from a company that sells ongoing services is a sales audit. It may surface real problems, but its findings exist to justify a proposal, and its scope will quietly stop at whatever the proposal covers.
One question sorts the market faster than any other: "Is the report mine to keep, written so I could hand it to a different provider or fix things myself?" A clear yes means you are buying findings. A hedged answer means you are buying a pitch. We answer yes in writing. Some clients have taken the report elsewhere, and that is how it should work.
What You Should Be Left Holding
Judge any assessment by its outputs. At the end you should have four things:
- A written report a business owner can read. Findings rated by severity and likelihood, with technical detail in appendices rather than the headline.
- A prioritized action plan sequenced by risk reduced per dollar. A wall of everything is not a plan.
- Reusable evidence. The documentation your insurance application, your board, or a client security review will ask for.
- A briefing to your leadership. A report nobody presents becomes a PDF nobody opens. Most clients tell us the briefing was the first time everyone in the room shared the same picture of the company’s risk.
What happens next is a decision, never an obligation. Work the list yourself, hand it to your current provider, or talk to us about fixing what we found. The assessment’s job is to make that decision an informed one.
The full week-by-week structure of ours is on the Sentry Inspect page. For a rough preview of what an assessment would find, the three-minute self-assessment covers the same nine areas at survey depth, free, with no email required.