Identity and access control
0% of the protections in this area
Enforce multi-factor authentication everywhere and move passwords into a managed business vault.
Fix this with us →Free security score
How exposedis your business?
22 plain-English questions across 8 areas of your security. You get a score out of 100, your risk tier, and the two areas to fix first.
Your cybersecurity score
0 / 100 …
Your score is calculated from 22 questions across 8 areas of your IT security. Critical protections, like multi-factor authentication, backups, and endpoint security, count extra, because they're what stop the attacks small businesses actually face.
Your results may not have reached our team. Your report is below; email security@upfortify.com if you'd like us to review it with you.
Low risk
Your security posture is strong.
Your organization has the core controls in place that stop the most common attacks against small businesses. That's genuinely uncommon.
What this means
The job now is maintenance. Threats evolve, staff changes, and controls drift over time. A strong score today doesn't guarantee one next year.
Recommended next step
Book a complimentary annual review. We'll validate what's working and flag anything that's drifted, with no sales pitch attached.
Moderate risk
You're on the right track, with a few gaps worth closing.
You have solid foundations, but a handful of missing controls leave openings that attackers routinely exploit. The good news: at this level, the fixes are usually straightforward and inexpensive.
What this means
You're doing better than most, but "mostly protected" is exactly where breaches happen. One unprotected entry point is all it takes.
Recommended next step
Get a prioritized fix list. We'll rank your gaps by risk so you close the dangerous ones first.
High risk
Your business is exposed in several critical areas.
Multiple core protections are missing or only partially in place. These are the same gaps behind most ransomware incidents affecting small businesses, and attackers increasingly target companies your size precisely because these gaps are common.
What this means
This is fixable, but it shouldn't wait. The highest-impact fixes are usually the least expensive ones.
Recommended next step
Book a free 30-minute security review. We'll walk through your results and build a remediation plan ordered by what reduces your risk fastest.
Severe risk
Your business is critically exposed.
Most foundational security controls are missing. Organizations at this level are the primary targets for ransomware and business email fraud, not because attackers single you out, but because automated attacks find these openings first.
What this means
Every week without these basics is a gamble. The first fixes, the ones that matter most, can typically be in place within days, not months.
Recommended next step
Talk to us this week. We'll prioritize ruthlessly: what to fix first, what it costs, and what you can safely defer.
Your two priority focus areas
These are the weakest parts of your security based on your answers. Fix these first: they reduce your risk the most.
Email and phishing
0% of the protections in this area
Add advanced email filtering and run regular phishing tests so staff recognize attacks before they click.
Fix this with us →Endpoints and devices
0% of the protections in this area
Put centrally monitored endpoint protection and automated patching on every business device.
Fix this with us →Network and remote access
0% of the protections in this area
Place a managed business firewall in front of your network and lock remote access behind VPN or zero trust with MFA.
Fix this with us →Backup and recovery
0% of the protections in this area
Automate daily offsite backups, and test restores regularly, so ransomware can't take you offline.
Fix this with us →Monitoring and response
0% of the protections in this area
Add 24/7 monitoring with alerts and a written incident response plan, so breaches get caught in minutes, not months.
Fix this with us →AI use
0% of the protections in this area
Approve a short list of business AI tools, publish an AI acceptable use policy, and review which AI apps can reach your email and files.
Fix this with us →Governance
0% of the protections in this area
Put basic written security policies in place and assign clear ownership for IT security.
Fix this with us →See all 8 areas
- Identity and access control0%
- Email and phishing0%
- Endpoints and devices0%
- Network and remote access0%
- Backup and recovery0%
- Monitoring and response0%
- AI use0%
- Governance0%
Get your free 30-minute security review
A plain-English walkthrough of your results with an Upfortify security specialist. You'll leave with:
- Your gaps ranked by actual risk, not by what costs the most to fix
- Clear explanations of each issue, without jargon
- A no-obligation remediation plan and quote
Book my free reviewNo pressure, no jargon. If we're not the right fit, you'll still keep the plan.
Questions, answered
How is my score calculated?
Your answers across 22 questions in 8 security areas produce a score out of 100. Critical protections, multi-factor authentication, backups, endpoint security, patching, and secure remote access, carry extra weight because they prevent the attacks small businesses face most.
Is this the same as a professional security audit?
No. This is a self-assessment: a fast, honest snapshot based on your answers. A formal Upfortify security review goes deeper: we verify controls hands-on, test your defenses, and document everything for compliance or insurance purposes.
Will you share my answers?
No. We never sell or share your answers. They reach us through our form provider and are used only to generate your report and prepare for your review call if you book one. Our privacy policy explains how we store and delete them.
We're in healthcare, finance or legal. Does this cover compliance?
The assessment flags areas that commonly overlap with HIPAA, PCI, and similar requirements, but it isn't a compliance audit. If you handle regulated data, mention it on your review call and we'll scope that properly.
Why does the score ask about AI tools?
Because staff already use them, often on personal accounts. Client data pasted into an unapproved chatbot, an AI app with access to a mailbox, or a note-taker recording a client call are all new ways for data to leave. The AI use questions show whether you know which tools are in use and have basic rules around them.
How often should we reassess?
At least once a year, and after any big change: new staff, new systems, a move, or (unfortunately) an incident.
This assessment is a self-reported snapshot for educational purposes and doesn't constitute a formal security audit or compliance certification. Scores reflect the answers provided.