Each check is a yes-or-no question about your business. Tick the ones that are already true, add up your score, and you'll see the gaps before an attacker does.
Backups run on an automated daily schedule.
Servers are patched on a defined monthly schedule.
MFA is enabled on email, VPN, and admin accounts.
Every device runs active antivirus/EDR, including remote laptops.
Staff complete security awareness training at least annually.
13–15 strong shape.
8–12 real gaps worth closing.
Under 8 you're exposed.