Security testing is useful when it answers a business question and leads to action. A list of findings on its own does not show that your business is better protected.
For an SME, the starting questions are practical: which systems matter most, where could an attacker gain access, who will fix the weaknesses and how would you recover?
Reviewed 23 October 2026.
1. Risk and configuration reviews
A review establishes what you depend on and whether the intended controls are in place. It can examine account access, exposed services, supported software, security settings and the responsibilities shared between your business and suppliers.
The output should explain the important gaps in business terms. For example, an administrator account without appropriate protection may need attention before a lower-risk setting on an isolated test system.
2. Vulnerability scanning
Scanners help identify known weaknesses and insecure configurations in the agreed environment. Results need checking, prioritisation and follow-up; a long report is not the same as completed remediation.
Confirm which assets are covered, whether authenticated checks are included, how often scans run and who acts on the findings. Rescan after important fixes to check the result.
See the NCSC guidance on vulnerability scanning and our CYDEFENCE vulnerability management service.
3. Penetration testing
Penetration testing investigates how weaknesses could be exploited within an authorised scope. It provides a different kind of assurance from a routine scan and has limits set by its scope, timing and methods.
Before commissioning a test, agree the systems included, permissions, testing window, escalation contacts and reporting. Confirm whether the work is automated, human-led or a combination. Plan how findings will be addressed and checked afterwards.
The NCSC describes penetration testing as part of a wider assurance programme. CIS provides CYATTACK automated network penetration testing; the appropriate approach depends on what you need to assess.
4. Recovery tests and incident exercises
A recovery test checks whether the business can use restored data and systems. An incident exercise checks the decisions and communication needed when normal work is disrupted. These tests answer questions that a vulnerability scan cannot.
Choose a realistic scenario, identify the services to restore first and record what happens. Note missing access, unclear responsibilities and dependencies on suppliers. Review the outcome through your backup and recovery plan.
Turn findings into work that gets finished
For each important finding, record an owner, its business impact, an agreed action and a target date. Keep evidence of the change and the check that followed it. Your next review should show completed improvements alongside the work still outstanding.
No test can establish that a business is impenetrable or prevent every future incident. Maintain access controls, supported systems, monitoring and recovery arrangements between assessments.
Our data security strategy guide explains how those controls fit together. Speak to CIS to agree the assessment and follow-up your business needs.
