Free cybersecurity assessments

See where your business stands – without the jargon or the sales call.

Each assessment takes 5–8 minutes. Answer honestly based on what’s actually happening in your business today. You’ll get a personalised report with your biggest gaps, practical next steps, and a clear risk level – before you decide what to do next.

All assessments are tailored for New Zealand and Australian businesses. We reference local requirements and guidance including the New Zealand Privacy Act 2020, NZISM, NCSC NZ guidance, the Australian Privacy Act 1988, ACSC guidance, the Essential Eight, and common cyber insurance underwriter expectations across the NZ/AU market. You’ll receive practical, locally relevant recommendations rather than generic advice.

You’ll see exactly which controls are missing, why they matter, and what to fix first. No registration is required to start, just honest answers. Your report is delivered by email and protected by a private token you can share with your team or your insurer.

How it works

Three steps to see where you are

Choose an assessment

Select the topic that matters most; Essential Eight, NIST CSF, Cyber Insurance, M365, AI, Vendor Risk, or SMB.

Answer plain‑English questions

Yes / Partially / No – based on what’s actually in place today, not what’s planned.

Get your free report

Risk level, priority gaps, and actionable recommendations. Share it with your team or your insurer.

Start here

SMB Cyber Readiness

A short, four‑section check for small businesses – identity, devices, backups, and email.

Designed for small to medium businesses that need a quick health check before a compliance review or insurance application. Covers MFA for all users, separate admin accounts, leaver processes, patching SLAs, endpoint protection, device inventory, automated backups, restore testing, incident response plans, DMARC, and security awareness training. A great starting point if you’re short on time – upgrade to the Essential Eight for deeper analysis.

Start assessment →

Essential Eight Readiness

Measure your maturity against the ASD Essential Eight – patching, MFA, backups, and more.

Widely adopted by NZ government agencies and businesses that work with them. This free Essential Eight maturity assessment for small businesses shows whether you meet baseline requirements for patching (critical within 14 days), phishing‑resistant MFA, application control, and offline backups. Aligned with NZISM and NCSC NZ guidance. Ideal for small‑medium enterprises tendering for government contracts or needing ASD‑aligned security.

Start assessment →

Microsoft 365

Microsoft 365 Secure Score Review

Evaluate your M365 tenant against Microsoft’s best practices – Conditional Access, PIM, Safe Links.

Is your Microsoft 365 Secure Score stuck below 50%? This assessment walks you through Conditional Access policies, legacy authentication blocking, Privileged Identity Management (PIM), Safe Links, and Safe Attachments – the exact actions Microsoft recommends. Ideal for NZ businesses using Business Premium or E3/E5 licences. Get a percentage score and a ranked checklist of missing controls.

Start assessment →

Microsoft Copilot Governance

Are you ready for M365 Copilot? Test sensitivity labels, permissions, audit logging, and use policies.

Copilot surfaces whatever your users can access. Before deployment, you need sensitivity labels, least‑privilege permissions, audit logging, and acceptable use policies. This assessment checks exactly those controls – plus DLP, guest access governance, and responsible use training. Perfect for NZ organisations planning to roll out Copilot without exposing confidential data.

Start assessment →

Frameworks and Compliance

NIST CSF Lite

A business‑friendly version of the NIST CSF 2.0 – covering all six functions.

Ideal for NZ organisations aligning with international frameworks without the overhead of a full audit. This assessment maps to the Privacy Act 2020 and helps you prepare for supply chain security requirements. You’ll get a maturity level for Govern, Identify, Protect, Detect, Respond, and Recover – with the overall score based on your weakest function. Great for compliance officers and risk managers.

Start assessment →

Cyber Insurance Readiness

Check the controls that NZ insurers now demand – MFA on email, EDR, immutable backups, DMARC.

Worried about your cyber insurance renewal? This assessment checks exactly what local insurers (Aon, Marsh, and NZ‑based underwriters) look for – MFA for all users and admins, endpoint detection and response (EDR), offline/immutable backups, patching SLAs, privileged access restriction, and DMARC enforcement. Missing any of these can lead to declined cover or claim exclusions. Get a clear “Not Ready / Needs Work / Likely Ready” result to show your broker.

Start assessment →

Emerging risk

AI Readiness Assessment

From policy and data handling to vendor risk and staff awareness – use AI safely.

AI tools like ChatGPT and Copilot are already in your business. This assessment covers governance (acceptable use, leadership approval), data handling (data mapping, PII exclusion, data residency), security controls (business accounts, shadow AI monitoring, API key security), vendor risk, and staff awareness. Ideal for tech, legal, finance, and healthcare organisations using or building AI tools.

Start assessment →

Vendor & Third‑Party Risk

Which suppliers have access to your data? Checks your vendor register, due diligence, contracts, offboarding.

Third‑party compromise is one of the most common attack paths. This assessment evaluates your vendor inventory, risk tiering, due diligence (security questionnaires, certifications like ISO 27001), contractual protections (DPAs, breach notification, audit rights), ongoing monitoring, and offboarding processes. Ideal for businesses that rely on MSPs, cloud providers, or any external party with system access.

Start assessment →

Where do I start?

Which assessment is right for you?

Assessment	Best for	Industry / situation focus
Essential Eight	Small to medium NZ businesses tendering for government contracts or needing ASD‑aligned security	Government suppliers, critical infrastructure, professional services
NIST CSF Lite	Compliance officers preparing for ISO 27001 or supply chain security audits	Any organisation aligning with international frameworks
Cyber Insurance Readiness	Businesses renewing cyber insurance after a claim or facing premium increases	Any business with cyber liability cover – especially finance, legal, healthcare
M365 Secure Score	IT managers with a Secure Score below 50% who need a prioritised action plan	Microsoft 365 tenants (Business Premium, E3, E5)
Copilot Governance	Organisations planning to deploy M365 Copilot in the next 3–6 months	Any business using Microsoft 365 with sensitive data
AI Readiness	Businesses using ChatGPT, Copilot, Claude, or building internal AI tools	Tech, legal, finance, healthcare, education
Vendor Risk	Businesses that rely on MSPs, cloud providers, or subcontractors with system access	Any organisation with third‑party access to data or networks
SMB Cyber Readiness	Small businesses (under 50 staff) wanting a quick, high‑level security check	Retail, construction, professional services, not‑for‑profit

FAQs

Frequently asked questions

Do I need to create an account?

No. You start answering immediately. We only ask for your email address to deliver your personalised report.

Are these certified audits?

No. These are self‑reported indicators, not formal audits or certifications. Use them as a starting point to identify gaps, then validate with a qualified assessor (like KIS) before making compliance decisions.

How long is my report valid?

Your report link is protected by a unique token and expires after set 30 days. You can share it with your team or your insurer during that time.

Which assessment should I take first?

If you handle customer data or run Microsoft 365, start with Essential Eight. If you’re applying for cyber insurance, start with Cyber Insurance Readiness. For a quick general check, use SMB Cyber Readiness.

Can I share my report with a colleague?

Yes. Each report includes a “Share with team” button. Your colleague will receive a summary and a unique link to the full report – their details are stored only to deliver the report, and they can request deletion at any time.

I’m a managed service provider (MSP), can I run these assessments for my clients?

Absolutely. You can run these on behalf of your client or send the client the link. Each assessment is completely free.

How do I know if my business meets cyber insurance requirements in New Zealand?

Take the Cyber Insurance Readiness assessment. It checks the six controls that NZ insurers now treat as non‑negotiable: MFA for all email accounts, EDR on endpoints, immutable or offline backups, patching SLAs, restricted privileged access, and DMARC enforcement. Your report will show which controls are missing – take it to your broker.

What is the difference between Essential Eight and NIST CSF and which one should I do first?

Essential Eight is operational and prescriptive – it tells you exactly which controls to implement (patching, MFA, backups). NIST CSF is strategic – it helps you build a programme across six functions. If you need to meet a government contract, start with Essential Eight. If you’re building a long‑term security programme, start with NIST CSF Lite.

Can I use these assessments for ISO 27001 gap analysis?

Yes, they are an excellent starting point. The NIST CSF Lite assessment maps closely to ISO 27001 Annex A controls, and the Essential Eight covers many operational controls required for ISO 27001:2022. Use the reports as input for your gap analysis but always follow up with a formal ISO audit.

How often should I retake the Microsoft 365 Secure Score review?

Every 3–6 months, or whenever Microsoft releases new Secure Score recommendations. Your tenant configuration drifts over time – new users, new apps, and policy changes can lower your score. The assessment helps you catch that drift.

What if i don’t know the answer to a question?

Answer honestly based on what you know. If you’re unsure, choose “Partially” – that flags that the control may not be fully implemented. Your report will still be useful, and you can validate the answer later with your IT team.

Are these assessments aligned with the NZ Privacy Act 2020?

Yes. All assessments are designed with Privacy Act obligations in mind, especially the security controls that protect personal information. If your report identifies gaps in access control, patching, or incident response, those are also areas where the Privacy Commissioner would expect to see adequate security safeguards.

Not sure which assessment to take first?

Start here

If you handle customer data or run Microsoft 365, start with the Essential Eight. If you’re applying for cyber insurance, start with Cyber Insurance Readiness. Still unsure? We’re happy to point you in the right direction. No obligation.

Book a free conversation

See where your business stands – without the jargon or the sales call.

Three steps to see where you are

Choose an assessment

Answer plain‑English questions

Get your free report

Start here

SMB Cyber Readiness

Essential Eight Readiness

Microsoft 365

Microsoft 365 Secure Score Review

Microsoft Copilot Governance

Frameworks and Compliance

NIST CSF Lite

Cyber Insurance Readiness

Emerging risk

AI Readiness Assessment

Vendor & Third‑Party Risk

Which assessment is right for you?

Frequently asked questions

Not sure which assessment to take first?

KIS

Services

Company

Useful links