Draft status: edit before promoting. Specific examples are placeholders.
“Security assessment” is one of the least-precise terms in B2B procurement. Two quotes with the same label can differ by a factor of 30 in scope, depth and outcome. Before you sign one, here are six questions that will tell you what you’re actually buying.
1. What methodology will you follow?
The wrong answer is a vague reference to “industry best practice”. The right answer names a framework — NIST CSF, ISO 27001 controls, CIS Critical Security Controls, ASD Essential Eight — and describes how the assessment maps to it.
A framework-aligned report has two benefits: the findings are scored against a recognised standard, and the remediation roadmap is auditable later. A “best practice” report leaves you with one consultant’s opinion.
2. What’s in scope — external, internal, or both?
There are three layers, and a real assessment names all three:
- External: what an attacker on the internet can see. DNS, exposed services, email authentication, public credentials in breaches, web application surface.
- Internal: what a compromised endpoint or stolen credential gets access to. Active Directory or Entra ID configuration, file share permissions, lateral movement paths.
- Configuration: what the security controls should be doing versus what they’re actually doing. Conditional Access in Microsoft 365, EDR coverage, backup integrity, MFA enforcement.
Many “assessments” are external-only. That’s useful, but it tells you nothing about the 80% of incidents that involve a credential first. Make sure the quote names which layers are covered.
3. Is this active testing or document review?
“Read the policy and check the configuration” is one kind of work. “Try to break in and see what happens” is another. Both have a place; they’re not interchangeable.
- Audit-style review (document + configuration inspection) is faster, cheaper, and finds the controls that don’t exist.
- Active testing (vulnerability scans, manual exploit attempts, phishing simulation) finds the controls that exist but don’t work.
Ask which one you’re getting. If the quote says “penetration test” but the scope is two days of work, that’s an audit dressed up.
4. What does the deliverable look like?
Ask to see a sample report from a previous (anonymised) engagement. Look for:
- An executive summary in plain English, not security jargon. If the CEO can’t read it, it doesn’t change behaviour.
- Findings ranked by risk, not just severity. A “high-severity” finding on a system no-one uses isn’t a high-risk finding.
- A prioritised remediation roadmap with effort and ownership. Findings without remediation guidance turn into a tracker that no-one closes.
- Evidence: screenshots, packet captures, scan output. Without evidence, findings are unfalsifiable.
Three formats to avoid: a spreadsheet of 400 line items, a 200-page PDF that no-one will read, or a Powerpoint deck that ends with “buy more from us”.
5. Is remediation included, or is that an upsell?
Some providers price the assessment low and make their margin on the implementation that follows. That’s not inherently wrong — but you should know which model you’re buying.
Three patterns:
- Pure assessment: findings + roadmap, you implement (or your existing IT does). Lowest cost, highest customer effort.
- Assessment + co-implementation: provider gives you the roadmap and helps your team execute the top items. Middle ground.
- Assessment + full remediation: provider runs both. Highest cost, lowest customer effort. The line between this and a managed service starts to blur.
There’s no universally right answer. The wrong answer is not knowing which one you signed up for.
6. Is there a credit-back if I engage you for managed services?
This is a small but useful signal. Providers confident in their managed offering will credit the assessment fee against the first months of a managed engagement, on the logic that the assessment is itself a sales process and should be paid for by the sale, not the prospect.
Providers without that confidence treat the assessment as a profit centre in itself. That’s fine, but it tells you something about how they price their work.
The shape of a good one
In our experience, a good Pacific-business security assessment looks like this:
- 3 to 6 weeks all in, depending on size
- Methodology explicitly mapped to NIST CSF or ISO 27001
- External, internal, and Microsoft 365 configuration all in scope
- Written report (10–25 pages, executive summary up front) plus a prioritised remediation roadmap
- 60-minute debrief call with the technical team, not just an account manager
- Credit-back policy if you engage for managed services within 60 days
If the quote you’re holding doesn’t match this shape, ask the supplier to explain why.
How we do it
Our Security Assessment follows this format. The standard rate is NZ$1,995, with a promotional rate of NZ$995 that credits back in full against the first three months of a managed engagement if you convert within 60 days. The promotional rate is selective — mention this post when you book and we’ll confirm availability.
Or if you’re not ready for a paid assessment, start with the free domain check. It covers the email-authentication layer of the external scope in 10 seconds.