Get a Written Assessment of Your Security and Compliance Gaps
Our security assessment is a 15-minute call, then written findings on five areas: dark web exposure, phishing risk, security controls, remote access and employee training readiness. Every finding comes with a specific recommendation.
The assessment is complimentary. You’ll know exactly where you stand and what needs attention.
Book 15 minutes for written security findingsNo cost • No obligation • Written findings delivered after the call
The assessment is run from Springfield, Ohio by Capstone Technologies Group, veteran-owned and in business since 2004, the IT and security provider for medical, legal, accounting and nonprofit offices in Springfield, Dayton and Columbus. The clients quoted on this site have been with us 16, 20 and 26 years.
- • Are applying for or renewing cyber insurance and need to answer technical questions on the application
- • Have compliance requirements they’re not confident they’re meeting (HIPAA, FTC Safeguards Rule, Ohio Rule 1.6)
- • Had a phishing incident, a close call, or an employee who clicked something they shouldn’t have
- • Have remote or hybrid employees connecting from home networks and personal devices
- • Know their security needs work but don’t have internal IT staff to evaluate it
What the Assessment Evaluates
We look at five areas that represent the most common gaps we find in small and mid-sized businesses, and the areas that cyber insurance underwriters, regulators, and auditors ask about most often.
Dark Web Exposure
We scan verified breach databases for credentials tied to your business domain: exposed email addresses, compromised passwords, and the breach sources they came from. Personal password reuse is one of the most common ways attackers get into business systems. We’ll show you exactly which credentials are exposed and which ones need immediate attention.
Phishing Risk
We evaluate your team’s exposure to phishing and social engineering attacks. Most breaches start with a human action: clicking a link, opening an attachment, or responding to what looks like a legitimate request. From your answers on the call, we assess how prepared your team is to recognize and respond to these attempts.
Security Controls
We talk through your current safeguards with you: multi-factor authentication, endpoint protection, backups, email security, and access controls. These are the technical controls that cyber insurance applications ask about and compliance frameworks require. We identify what’s in place, what’s missing, and what needs attention.
Remote Access & Hybrid Workforce
If employees work from home or connect remotely, we talk through how that access is set up: VPN security, home network exposure, personal device policies, and whether remote connections create gaps in your security. Remote workers face different risks than office-based staff, and most businesses haven’t addressed them specifically.
Training Readiness
We ask whether your team has current, documented security awareness training and phishing simulation results. Those are the specific records that underwriters commonly require for application approval. If gaps exist, we can provide documented training certificates and simulation results for enrolled employees through our managed training program.
How the Assessment Works
The process is straightforward. No software to install, no access to your network or systems, and no obligation.
Schedule a 15-Minute Call
Pick a time that works for you. We’ll walk through your current environment, what systems you’re using, how your team connects, and what compliance requirements apply to your business.
We Do the Research
After the call, we run a dark web scan on your domain, look at what your network shows to the internet, and check your domain and email records, all from the outside. Then we review what you’ve told us about your phishing readiness, security controls, remote access and training against your industry’s requirements.
Review Your Findings
You’ll receive a written report with an executive summary, our findings across all five areas, and action items prioritized by risk level. We’ll schedule a follow-up to walk through the findings and answer questions. If you have an existing IT provider, we can send the findings directly to them so they can close the gaps for you.
What You Receive
The assessment produces a written report with an executive summary and action items. You’ll get specific findings you can act on whether you work with us or not.
Written Security Findings
A report documenting what we found across all five assessment areas: dark web exposure results, security control gaps, remote access risks, phishing readiness, and training status.
Prioritized Recommendations
Each finding is categorized as Critical, Warning, or Informational, so you can distinguish between an insurance-denial risk and a general best-practice suggestion. You’ll know what to address first, what can wait, and what it takes to close each gap, with or without our help. If you ask us to close a gap, the cost is no mystery: see the monthly tiers and the hourly rate and put a number next to each recommendation before you decide anything.
Compliance Mapping
If your business is subject to specific regulations (HIPAA, FTC Safeguards Rule, Ohio Rule 1.6, SEC requirements), we’ll map the controls you describe against those requirements so you can see where you meet expectations and where you have gaps.
Home Networks Are Often Your Weakest Link
Remote and hybrid work introduced risks that most businesses haven’t specifically addressed. When employees connect from home, they’re operating on consumer-grade routers with default settings, sharing networks with personal devices, and often accessing business systems from laptops that don’t have the same protections they’d have in the office.
On the call we ask how your remote employees connect, what devices they’re using, how your VPN or remote access is set up, and whether you have policies in place for BYOD (bring your own device), home network security, and acceptable use. These are the areas where we most commonly find gaps, not because businesses are careless, but because remote work scaled faster than the security policies around it.
If your team works entirely on-site, we’ll note that and focus the assessment on the other four areas. The assessment adapts to how your business actually operates.
If the Assessment Reveals Training Gaps
One of the most common findings is that employees either haven’t completed security awareness training or the training isn’t current and documented. This matters because cyber insurance applications specifically ask about it, compliance frameworks require it, and phishing simulations consistently show that trained employees are significantly less likely to click on malicious links.
If training gaps come up in your assessment, we can recommend a program that includes ongoing security awareness training, simulated phishing exercises, and dark web monitoring for your domain, with completion tracking and documentation for insurance and compliance purposes. That’s a separate conversation, but we’ll let you know if it’s relevant to your findings.
Common Questions
The initial call takes about 15 minutes. After it, we run checks from outside your network, with no access to your systems: a dark web scan for exposed email addresses and passwords, a look at what your network shows to the internet, and a review of your domain and email records. Within a few business days we send the written findings and schedule a follow-up call to walk through them.
Yes. We do this to establish a baseline of where your security stands. You get the written report regardless of what happens next. If we’re a fit to help you close the gaps, we’ll talk then. The findings are yours either way.
Not for the initial assessment. Every check we run is from outside your network. The rest of the evaluation is based on what you tell us about your current environment during the call. If you have a server, firewall, network storage or cloud services, the report covers what we can see from the outside and usually recommends an on-site review to document how they are set up. That review is separate, paid work, and booking it is up to you. See what the risk assessment covers. The initial assessment doesn’t require any access to your network or systems.
That’s fine. Many businesses that request an assessment already have someone managing their IT. The assessment gives you a second look from the outside. It can identify gaps your current provider may not have addressed, and it shows you which controls to confirm with them. The findings are useful regardless of who implements the recommendations.
We specialize in regulated industries: medical practices, law firms, CPA firms, financial advisors, and registered investment advisors. We also work with small businesses and nonprofits across Ohio. The assessment is tailored to your industry’s specific compliance requirements.
Yes. The assessment covers the same areas that cyber insurance applications ask about: MFA, endpoint protection, backups, training, and incident response planning. The written findings can help you answer application questions accurately and identify gaps to address before renewal.
“…With all the new rules and regulations in relation to security, I am glad to have Brian and Capstone Technologies for all my IT needs.”
Ashok D., MD
Find Out Where Your Security Stands
15-minute call to review your current safeguards, documentation gaps, and what you’d need for insurance applications, compliance requirements, or general security improvement.
No cost • No obligation • Written findings delivered after the assessment
Prefer to Send a Message?
If you’d rather not book online, submit your information below and we’ll reach out to schedule the assessment.
