Five questions. Then you know where to start.

How it works

• Five questions about how security is organised, not a technical audit.

  They are the questions I would ask in the first ten minutes of a call: who owns security, what is monitored, how patching is decided, what happens when something goes wrong, and which obligations apply to you. No tool touches your systems and nothing is scanned.

• Your answers stay in the browser.

  There is no registration and no account. The questions run entirely on this page and nothing is sent anywhere unless you explicitly ask for the report by email at the end.

• You get a starting point, not a score.

  At the end you see which area is weakest in your setup, why it matters given what you answered, and the one thing worth doing first. A number out of a hundred would tell you nothing useful.

What this is not

Being clear about the limits is part of the point. Five questions cannot replace an assessment, and a tool that pretends otherwise is selling you something.

• It is not a penetration test. Nothing is probed, scanned or connected to. The diagnostic never reaches your network.
• It is not a vulnerability assessment. If you need to know which CVEs affect the products you run, the CVE Stack Analyzer on this site is the tool for that, and even that one is an indicator rather than an inventory.
• It is not a compliance audit. NIS2, DORA and ISO 27001 need evidence, control mapping and an assessor. This tells you whether you are close or far, not whether you would pass.
• It does not replace a conversation. It makes the conversation shorter and more concrete, which is the whole reason it exists.

Common questions

How long does it take

About five minutes. There is nothing to prepare and no document to collect beforehand.

Is any data stored

No. The answers never leave the browser. If you choose to receive the report, the email address is used to send it and nothing else — the privacy policy on this site describes exactly what is processed and why.

Does it cost anything

No, and there is no obligation afterwards. If the result tells you that you are already covered, that is a perfectly good outcome.

Who is it for

Small and medium companies without a dedicated security team, and IT managers who have inherited a stack somebody else built. If you already run a security programme with an owner and a roadmap, it will not tell you much you do not know.

What happens after

Nothing automatic. No sequence of emails, no follow-up call you did not ask for. If the result is useful and you want to talk it through, there is a free thirty-minute scoping call you can book yourself.