Assess Your Breach Risk
Answer 20 technical questions to evaluate your organization's exposure to real-world attack paths.
Which industry best represents your primary operations?
Which industry best represents your primary operations?
Where is multi-factor authentication NOT consistently enforced?
*
Where is multi-factor authentication NOT consistently enforced?
How is your identity provider secured?
*
How is your identity provider secured?
How are privileged/admin accounts managed?
*
How are privileged/admin accounts managed?
How are service accounts and secrets managed?
*
How are service accounts and secrets managed?
How do you detect and prevent session/token abuse?
*
How do you detect and prevent session/token abuse?
What is the coverage level of your EDR/XDR solution?
*
What is the coverage level of your EDR/XDR solution?
What is your endpoint security baseline?
*
What is your endpoint security baseline?
What is your remediation window for critical vulnerabilities (CVSS 9–10)?
*
What is your remediation window for critical vulnerabilities (CVSS 9–10)?
How complete is your asset visibility?
*
How complete is your asset visibility?
How is lateral movement restricted?
*
How is lateral movement restricted?
How well do you understand your external exposure?
*
How well do you understand your external exposure?
How quickly would you detect a compromised endpoint or account?
*
How quickly would you detect a compromised endpoint or account?
What detection stack is in place?
*
What detection stack is in place?
What level of logging visibility do you have?
*
What level of logging visibility do you have?
How long are logs retained?
*
How long are logs retained?
How is application security managed?
*
How is application security managed?
How is sensitive data access managed?
*
How is sensitive data access managed?
Do you have an incident response capability?
*
Do you have an incident response capability?
What is your recovery capability?
*
What is your recovery capability?
