Most business owners find out about their security gaps the hard way: after a hacked mailbox, a ransomware attack or a payment sent to the wrong account. A security review lets you find those gaps first, while fixing them is still cheap and calm.
But "IT audit" can mean anything from a ten-minute online scan to a weeks-long consultancy project. This article explains what a good security health check should cover, how the process works and what you should get at the end.
Why bother with a security review?
Even businesses with an IT provider often don't really know where they stand. Things drift over time: a new starter set up in a hurry, an old account never removed, a backup that stopped working months ago, a firewall nobody has looked at since it was installed.
A health check gives you:
- A clear picture of where your real risks are
- A prioritised list of what to fix first, and what can wait
- Evidence for clients, insurers and regulators that you take security seriously
- An independent view of how well your current IT is being looked after
When should you get one?
A security review is particularly worth doing if:
- You've never had one, or it's been more than a year
- Your business has grown quickly without anyone reviewing the IT
- You're filling in a cyber-insurance proposal form and aren't sure of the answers
- You've had a near miss, such as a phishing email that almost worked
- You hold sensitive client data, as solicitors, accountants and clinics do
- You're not sure whether your current IT provider has everything covered
What a good health check covers
A meaningful review looks at the places attackers look first. At CastCom, our Security Health Check covers six areas.
1. Your people
Most attacks start with an email. We send a safe, simulated phishing email to see who clicks. Nobody gets in trouble. The point is to understand how well your team can spot a convincing fake, so training can be targeted where it's needed.
2. Microsoft 365
For most businesses, Microsoft 365 holds the crown jewels: email, files and calendars. We check:
- Whether multi-factor sign-in is on for every user
- How many admin accounts there are and how they're protected
- Hidden forwarding rules that could be sending email elsewhere
- Sharing settings for files and folders
- Whether your Microsoft 365 data is backed up independently
3. Your computers
We check every computer for missing security updates, outdated or unsupported software, whether disks are encrypted (important if a laptop is lost or stolen) and whether antivirus is active and up to date.
4. Your email domain
Could someone send email pretending to be your business? We check your SPF, DKIM and DMARC settings, the three records that stop criminals impersonating you to send fake invoices.
5. Your network
We review your firewall, your Wi-Fi setup and how staff connect remotely, looking for open doors, old equipment and weak settings.
6. Leaked passwords
We run a dark web check for your company's email addresses to see whether any have appeared in data breaches, so they can be changed before they're used.
How the process works
A good health check shouldn't disrupt your business. Ours works in three steps.
Step 1: A short call (about 15 minutes). We learn about your business, how many people and computers you have, what systems you use and anything you're already worried about. We agree the scope together.
Step 2: The assessment (2–3 weeks). Our senior security engineer visits to check your firewall, Wi-Fi and network on site, at a time that suits you. The rest of the checks run remotely in the background, and your staff carry on working as normal. Any access we need to your systems is agreed with you in advance.
Step 3: The review meeting (about an hour). We walk you through the findings in plain English and answer your questions.
What you should get at the end
The report is where many audits fall down. An 80-page automated PDF full of technical jargon isn't much use to a business owner. A good report should be something you can actually read and act on.
Our report includes:
- Your top risks, ranked, with what each one could cost you if it's not fixed
- A prioritised fix list: what to do now, what can wait and what you can safely ignore
- Quick wins: often several important fixes cost little or nothing
- Documentation for your insurer, useful when completing a cyber-insurance questionnaire
- A fixed-price quote if you'd like us to fix anything, with no obligation to use us
It's written by the engineer who did the work and reviewed before it reaches you, so it reflects your business, not a template.
What it costs
Our Security Health Check is free when you act on what we find: either sign up for CastCom Essentials, or order the fixes we recommend at a fixed price, within 60 days of your report.
If you decide not to go ahead, the Health Check is priced by the size of your business (ex VAT): €250 for up to 10 users, €500 for 11–20 users, and €1,000 for 21 or more. A fix order must be worth at least the Health Check fee.
What a health check isn't
It's worth being clear about the difference between a health check and some other services:
- It isn't a penetration test. A penetration test is a deeper, more technical exercise where specialists actively try to break into your systems. Some businesses need one, often because a client or regulator asks for it, and a health check will tell you whether you're one of them.
- It isn't a certification. It won't give you a certificate, but it will show you where you stand and what to do next.
- It isn't a sales pitch. If everything is in good shape, we'll tell you so.
How to prepare
You don't need to do much, but a little preparation helps:
- Make a rough list of the systems you use: email, accounts or practice software, file storage, remote access and any websites or apps that send email as you.
- Find out who has admin access to Microsoft 365, your website and your domain.
- Dig out your cyber-insurance questionnaire if you have one, so we can make sure the report helps you answer it.
- Tell your team that a simulated phishing test may happen at some point, without saying when.
- Note anything that worries you. A strange email, a slow system or a past incident is all useful context.
Do you have to be a CastCom client?
No. Many businesses book a health check to get an independent view of their current IT provider or in-house setup. You're free to take the report and fix things yourself, ask your existing provider to fix them, or ask us.
The bottom line
You can't fix risks you don't know about. A security health check gives you a clear, honest picture of where your business stands, and a plan you can actually follow, before an attacker finds the gaps for you.
Ready to find your gaps first? Book a Security Health Check or call us on 01 820 0739.