Comprehensive Security Health Check

An integrated review of security posture, key risks and improvement priorities within an agreed scope

We search like an attacker and check like a defender.

We look at hacking and security issues from both sides: where an attacker would start and what they would go after, and whether your organisation could stop it, notice it and recover. Within an agreed scope, we cover the organisation from external exposure to services and infrastructure, access, sensitive data and readiness to respond. We combine relevant expertise around your environment and priorities, validate what matters, and identify key risks and improvement priorities.

Where do we stand overall?

We bring together confirmed risks and improvement priorities.

Reviewed

Five perspectives reviewed together, their results brought into one order of what to fix first.

Two views: attacker and defender

Breaches happen along a path, not at a single weakness. So we look at the same organisation twice: once from the side trying to get in, once from the side holding the line.

Where the two views disagree, where an attack gets through and the defence does not notice, is what to fix first.

The attacker's five moves and the defender's five questions. In this example the attack passes the defence at access and at readiness, and those two places are what to fix first.

ATTACKER

The attacker's view

Is there a way in, and how far does it reach?

We follow the information and methods real attackers use, from outside in. We look for what is exposed, try the open doors, and trace how far accounts and permissions would carry an intruder and what they could take or stop.

DEFENDER

The defender's view

Can it be stopped, noticed and undone?

We check whether your safeguards, people and procedures do their part against that attack: whether you know what is exposed, whether it is blocked, whether boundaries hold, whether anything unusual is noticed, stopped and reversed, and whether logs remain to explain what happened.

What sets it apart

It does not stop at a list of vulnerabilities. We check how problems actually connect into harm, and whether your organisation could stop it and notice it.

Seen one by one, each risk looks low; linked together, they form a path to sensitive data. We judge how serious a risk is by that path.

Two views, not one

We search with the methods real attackers use, and check whether your safeguards and procedures do their part against them. Gaps that one side alone would miss show up where the two views meet.

Across the whole organisation

Within an agreed scope, not one system but everything from traces visible outside to services and infrastructure, accounts and permissions, sensitive data, people and procedures. Attackers do not respect the lines between teams and systems.

Paths, not dots

Problems that look small on their own can reach sensitive data once they connect. We link findings into paths and judge each risk by the harm that could really follow.

Validated where it matters

We do not stop at questionnaires and checklists. Within the agreed scope, important risks are confirmed directly with the methods and technology of threat investigation, penetration testing and red teaming.

Facts kept apart from assumptions

We separate confirmed problems, signs that need a closer look, and what this review did not cover. We never call something safe that we did not check.

It ends with what to fix first

Findings are not just listed. We set an order for what to fix first by business impact and evidence, and explain it to decision-makers and to the people doing the work.

The Comprehensive Security Health Check is an integrated assessment that combines several areas of specialist expertise. Each perspective is checked with the methods and technology behind SAFE SQUARE's professional services.

Related research: Security Intelligence & Validation (INTEL · EXPLOIT) — We analyse exposure and attack surfaces, and develop techniques to verify vulnerabilities and their real-world impact.

What we check

We split hacking and security issues into five perspectives and ask the attacker's and the defender's question for each. The issues below are examples; what we actually examine follows your environment and concerns.

EXPOSUREExternal exposure and threatsAssets, accounts, brand and information visible from outside, and related signs of threat.
Attacker
If they came for us, what would they look for first?
Defender
Is anything open or leaked that we don't know about?
Issues we look at
- Forgotten domains and test servers
- Admin and remote access open to the internet
- Leaked staff credentials
- Keys and settings left in public repositories
- Sites and apps impersonating you
- Signs of leaked data being traded
SERVICEServices and infrastructureMain components, recent changes, known vulnerabilities, and hands-on validation where needed.
Attacker
Where could they get in, and do known attacks work?
Defender
Do protections still hold after recent changes and in old setups?
Issues we look at
- Web, app and API vulnerabilities
- Unpatched VPNs, servers and devices
- Cloud misconfiguration
- Default accounts and weak passwords
- Open-source and third-party components
- Hands-on validation with attack techniques
ACCESSAuthentication, permissions and boundariesUser and administrator permissions, business flows, and trust and isolation between systems.
Attacker
With one account, how far could they spread?
Defender
Do permissions and boundaries block what they were designed to?
Issues we look at
- Leavers' and shared accounts
- MFA exceptions and bypasses
- Excessive admin rights
- Ordinary users reaching admin functions
- Paths between the internal network and the cloud
- Partner and contractor access
DATASensitive information and operationsHow information is processed, stored and transferred, and the configuration, operation and safeguards around it.
Attacker
Where is the most valuable data, and how could it be taken or locked?
Defender
Do we know where sensitive data flows and who sees it, and could we restore it if lost?
Issues we look at
- Where customer data is stored and who can reach it
- Encryption and key management
- Backups that survive ransomware
- Real data left in logs and development environments
- Information sent to outside collaboration tools and AI services
- Operational settings and change management
READINESSReadiness to respondWhether the people, procedures and safeguards involved can do their part when needed.
Attacker
How long could they stay without being caught?
Defender
Could we notice, stop, recover and explain?
Issues we look at
- Collecting and keeping the logs needed to trace
- Who hears about warning signs
- Who is told and who decides in an incident
- Recovery procedures and practising them
- Readiness for phishing and other attacks on people
- Contacts with outside agencies and partners

Scope and depthWe agree the targets and conditions first. How deep we go and how much effort we put in follow from those targets and conditions, not from a fixed tier. It does not cover every asset and technology without limit, and follow-up testing is not automatically included. Nor is it a required first step before other services. Every service can be contracted on its own or combined with others.

When it fits

You've never had a proper security review
You have never had a comprehensive review, or the last one is out of date, and after staff changes or rapid growth no one knows the whole system any more.
When an incident hits close to home
A company in your industry or one you work with has been breached, you are asked whether you are all right, and you need to answer with evidence rather than guesses.
Someone is asking where you stand
Your CEO or board, an investor's due diligence, a customer's security requirements, a partnership or an audit needs your current security state explained with evidence.
When your environment has changed a lot
A move to the cloud, a merger or acquisition, a new service launch or a new person in charge of security has changed your systems and organisation, and you need to see how things stand from the start.
You need evidence to set priorities
Budget and people are limited, and you need evidence to decide which risks to address first.

How it runs

Agree the concern and scope
Starting from what worries you, we agree the targets and conditions, what you share with us, what access we get, and where and when testing may take place.
Map the current state
From documents on architecture, configuration, permissions and data flows, we build a picture of your environment and single out what an attacker would target and what must be protected.
Check from both sides
From the attacker's side we investigate what is exposed and validate whether it actually works; from the defender's side we check whether that attack would be stopped and noticed. Anything that could affect a service runs only if agreed beforehand.
Report and explain
We explain the confirmed problems, open signs and what to fix first, to decision-makers and to the people doing the work.

What you receive

What we checked and under which conditions, a summary of your security state, findings backed by evidence, business impact and improvement priorities.

SAMPLEWhat to fix first: an exampleA made-up example for illustration

A leaver's account still allows remote access from outside
Attack path
1. Leaked account
2. Remote access (VPN)
3. Internal file server
Defence gap
No multi-factor authentication, and no alert on unusual logins

Why first
The path is short, and nothing would notice an intruder
Backups can be deleted with the same admin rights as production
Attack path
1. Admin account taken over
2. Backups deleted
3. Ransomware launched
Defence gap
Backups are not separated, and there is no record of a recovery drill

Why first
Operations and the means to recover could be lost at once
A domain resembling your company name was newly registered
Attack path
1. Lookalike domain
2. Phishing mail to staff
3. Accounts taken over
Defence gap
Some of the settings that verify mail senders are missing

To confirm
Whether the domain actually sends mail still needs to be checked

Confirmed problems

Issues we verified, with the evidence and conditions under which they occur.

Signs that need a closer look

Observations that are not yet confirmed, kept apart from facts, with what it would take to confirm them.

What this review did not cover

Areas outside the agreed scope or not reachable under the conditions, stated plainly.

Where you standFor decision-makers
Your current state across the five perspectives, written for decision-makers.
Findings and evidenceFor the people doing the work
For each problem, the evidence and conditions, the attack path and defence gap, and the direction for improvement, so your team can confirm it and fix it.
What to fix firstFor both
An order for what to fix first, set by business impact and evidence, with the reasons for that order.