Posted on January 30, 2025January 30, 2025

There are many security assessments — risk assessments, vulnerability assessments, security control assessments, and pentation tests. Since they are all designed to help you become more secure, they might seem interchangeable. But each of them actually serves a very distinct purpose. And without some clarity, this mix-up can cost you a lot of money and time or leave your company vulnerable to potentially devastating security threats.

With businesses being increasingly mandated to provide a cyber security assessment to mitigate security risks, it has become crucial for small and medium-sized business leaders to know the difference — even if cybersecurity isn’t their area of expertise.

Our colleague and compliance expert, Shawn Duffy of Duffy Compliance, encounters this confusion regularly. “I can’t tell you how many times people reach out to me and say, ‘I need a penetration test.’ The first question I ask is, ‘What are you trying to get out of it?’ Nine times out of ten, they actually need something entirely different,” he explains.

So, to hopefully save you from paying for a security risk assessments you don’t need, can’t use, or don’t understand, we sat down with Shawn to get you some great insight on the topic of assessments, including:

• The purpose of each type of security assessment and when you actually need them.

• What results you should expect from each assessment.

• How to choose the right vendor and get truly useful actionable insights that you can implement.

Understanding the Types of Security Assessments

Various cybersecurity risk assessments are essential for identifying weaknesses and protecting your organization, but it’s important to understand how these assessments build on each other and why you might need one over the other to strengthen your security posture and be compliant.

“The type of assessment you need depends on where you are in the security risk assessment process,” explains Shawn.

1. Vulnerability Assessment: The Foundation

A vulnerability assessment is used to identify any basic technical flaws in your systems that could allow attackers to exploit your network or applications. These could be anything from open ports to misconfigured access control systems to unpatched software or outdated protocols.

“Typically, what I start with is the vulnerability assessment because it’s the broadest,” explains Shawn. “It shows me all the security vulnerabilities and gives me a foundation to work from to address their security risks.”

Vulnerability assessments rely on automated testing tools and network security scanners to identify vulnerabilities and provide a comprehensive list of security weaknesses to address.

House Analogy: Think of your organization as a house. The vulnerability assessment process is like looking for every potential entry point a robber could exploit. Open windows, doors with no locks, etc. It gives you a detailed list of all the places that need attention to secure your home.

2. Security Control Assessment: Verifying Your Defenses

A Security Control Assessment evaluates the systems designed to protect your organization. A security control assessment examines tools like firewalls, spam blockers, two-factor authentication (2FA), and role-based access controls to ensure they’re implemented and functioning as intended.

“Security controls are all the tools we rely on to keep us safe, but sometimes it’s not about security vulnerabilities—it’s just a configuration problem,” Shawn explains. For example, a firewall might be active but misconfigured, leaving a critical gap in your defenses.

Security control assessments often complement vulnerability testing. While a vulnerability assessment identifies flaws in your systems, security control assessments ensure your defensive tools are working as expected.

House Analogy: If vulnerability assessments check for weak points, a security control assessment tests your alarm system, motion sensors, and locks to ensure they’re functioning properly. It tells you if the security measures you’ve already put in place are working as expected.

3. Penetration Testing: Simulating Real-World Attacks

Penetration testing (pen testing) is the next logical step after addressing vulnerabilities and verifying your security controls. This advanced security assessment simulates an attack to test how well your systems can withstand different exploitation attempts.

“When I feel comfortable that yes, my system has everything patched and everything configured correctly and it’s robust enough, then I want to do a penetration test,” says Shawn. “I use it to see if my defense team recognizes an attack happening and how well the system responds.”

Pen testers think like hackers and use creativity and advanced techniques to uncover weaknesses and vulnerable systems that automated tools might miss. However, pen testing should only be conducted after known vulnerabilities have been addressed. Otherwise, you risk spending resources pen testing defenses with basic flaws.

House Analogy: Pen testing is like having a friend attempt to break into your home to see how secure your house will be in a real-life scenario. Pen testing asks, “Can an attacker pick the lock or disable the alarm? Or could they do something unexpected like climb through a cat door?”

4. Risk Assessment: A Holistic View

While the above security risk assessments build on each other to address specific technical and procedural weaknesses, a risk assessment takes a broader approach. It focuses on the potential impacts of risks to your business operations, considering everything from technology to operations to organizational structure.

“Risk assessments deal with how much it’s going to cost me and how much damage I’m going to take if a threat event happens,” says Shawn. “It’s not just about technology—it’s about how each risk could impact your business as a whole.”

A good risk assessment will cross-reference vulnerability databases and threat intelligence feeds to provide real-time insights into emerging threats and their potential impacts on your business.

Risk assessments are typically divided into three tiers:

1. Information Security Risks: Addressing vulnerabilities in your network and computer systems, like unpatched servers or outages.

2. Business Processes: Evaluating operational risks, like staffing shortages due to an outbreak or whether your offboarding procedures will protect you from a disgruntled employee.

3. Executive-Level Risks: Assessing the broader public relations impacts an event could have on your brand, partnerships, and customer trust.

House Analogy: A risk assessment is like asking, “What happens if someone actually breaks in?” It poses questions about the value of the items in your house, what’s most at risk, the potential cost of repairs or replacements, and whether people will feel safe in your home going forward if a break-in occurs.

When and Why You Might Need These Security Assessments

As mentioned above, each assessment provides you with a different set of answers that will only be truly useful in certain instances. Here, we’ll break down when you might be in need of each different security risk assessment and what insight a good report should give you.

Vulnerability Assessment

When you need it: Prioritize getting a vulnerability assessment report if you want to identify technical weaknesses like unpatched systems, known software vulnerabilities, or misconfigured settings that could leave you exposed to system or network security attacks. This is often the first step for SMBs meeting compliance security requirements such as HIPAA, CMMC, or ISO.

What you should get:

• A comprehensive vulnerability analysis with a detailed breakdown of all potential security risks and their severity.

• Prioritized recommendations for remediation, starting with the most critical issues.

• A plain-language summary of findings to ensure your team understands what to fix.

• Vendor Insight: Regardless of the vulnerability assessment tools used, the vendor should provide actionable steps and avoid overwhelming you with unnecessary technical jargon.

Security Control Assessment

When you need it: Conduct a security control assessment after addressing known vulnerabilities to ensure your firewalls, spam blockers, and two-factor authentication (2FA) are working effectively. This is especially important for organizations relying on multiple security tools.

What you should get:

• Confirmation that your security controls are configured correctly and working as intended.

• Identification of misconfigurations or gaps in your defenses.

• Suggestions for optimizing or strengthening your controls.

• Vendor Insight: The vendor should integrate findings from the vulnerability assessment, ensuring your controls address the identified risks effectively.

Penetration Testing

When you need it: Perform penetration testing after tackling your vulnerabilities in order to test your readiness against real-world attack scenarios. Compliance frameworks for high-risk industries like finance or healthcare often require it.

What you should get:

• A detailed security risk assessment report on how the test was conducted, including the methods used to exploit vulnerabilities.

• Insights into how attackers could gain access to critical assets and sensitive data.

• An evaluation of your incident response team’s ability to detect and react to the simulated attack.

• Vendor Insight: The vendor should ensure the pen test is conducted after vulnerabilities and controls have been addressed to maximize its value.

Risk Assessment

When you need it: Conduct a risk assessment when you want to evaluate the broader business impact of threats, from IT outages to staffing disruptions. It’s ideal for aligning your security efforts with your organization’s goals to help you prioritize your investments.

What you should get:

• A strategic overview of security risks, vulnerabilities, and the potential impact of threats on your organization.

• Recommendations for mitigating security risks across all areas of your business, from IT to operations to executive-level concerns.

• Alignment with frameworks like NIST SP 800-30 (Conducting a Risk Assessment) and SP 800-37 (The Risk Management Framework) for consistency and reliability.

• Vendor Insight: The vendor should help you understand how security risks impact your business, not just list vulnerabilities or threats.

How to Find the Right Security Assessment Vendor

Choosing the right cybersecurity vendor can save you from paying for completely inactionable reports that are just a series of confusing metrics and they won’t help you minimize threats or maximize your security investments. As Shawn tells us, “A good security risk assessment vendor doesn’t just hand over a technical report. They should give you a roadmap that helps you prioritize and act on the findings so you can implement security controls. If you don’t understand the report or what’s being asked of you, it’s not your fault—it’s your vendor’s job to communicate effectively.”

Some key considerations you should prioritize when looking for a good vendor is:

1. Clear Communication: Look for vendors who can explain their findings in plain language and provide practical next steps that are easy to understand and can actually help you in your risk mitigation efforts.

2. Tailored Reports: The best vendors deliver customized reports, prioritizing the most critical issues relevant to your specific systems and ensuring you know where to focus your efforts first.

3. Specialized Expertise: Ensure the vendor has experience in the type of assessment you need, whether it’s vulnerability scanning, penetration testing, or evaluating security controls.

Questions to Ask a Potential Security Risk Assessment Vendor

Ask any potential vendor these questions to get a better sense of whether you’ll get a report you can truly use:

1. What frameworks or standards do you follow?
   Ensure the vendor aligns with recognized guidelines like NIST, ISO, or others relevant to your industry.

2. What deliverables can I expect?
   Look for specifics, such as detailed reports, remediation recommendations, and debrief sessions.

3. How will findings and recommendations be communicated?
   Vendors should explain results in plain language with clear action steps.

4. Do you have specialists for this type of assessment?
   Verify they have expertise in the specific services you need.

5. What’s your timeline?
   Understand how long the assessment will take and whether the timeline meets your business needs.

If you need assistance deciphering complex regulatory language, get in touch with Shawn at Duffy Compliance.

Or, if you need help finding the best cybersecurity solutions to keep you safe and secure, contact Krister Dunn at kristerd@reliabletechnology.co.

RTS is ready to help your business grow by strategically leveraging technology. We can supplement your internal IT department, or be your fully outsourced managed IT services team.