1. Accounts & Sign-In
Who has access to what. Multi-factor sign-in coverage, administrator accounts, former employees still active, shared logins and password policy.
For Tampa Bay Businesses · Flat Fee · Written Report in 5 Business Days
Business Risk Assessment
Find out exactly where your business is exposed before an attacker, an insurer, or an auditor does. We inspect your accounts, email, computers, backups, network and internet footprint, then hand you a plain-English report that ranks every finding and tells you what it costs to fix.
$495 flat for up to 10 computers · credited toward your plan if you start one within 30 days
7Risk Areas Inspected
190Checks, Depending on Your Setup
5Business Days From Visit to Report
$495Flat Fee, Up to 10 Computers
Why Start With an Assessment
Can you answer three simple questions? Is every email account protected by multi-factor sign-in? Would our backups actually restore if ransomware hit tonight? Does anyone outside the company still have access? Cyber insurance applications now ask those questions in writing, and a wrong answer can put a claim at risk.
The assessment replaces guesses with evidence. You get a scored picture of where you stand today, the fixes to do first, and a clear price for the work, so you can decide what to do with real numbers in front of you instead of a sales pitch.
Who It's For
- Offices with 3 to 50 computers that have never had an outside security review
- Businesses filling out a cyber insurance application or renewal
- Law, medical, accounting and financial offices with client-confidentiality obligations
- Owners who want a second opinion on their current IT provider or in-house IT person
- Companies bidding on contracts that ask about security practices (government, healthcare, defense supply chain)
What We Inspect
Seven Areas, One Score Each
Every finding is rated Critical, High, Medium or Low, and each area gets a red, amber or green score so you can see at a glance where the real exposure is.
2. Email
Where invoice fraud and account takeovers start. Hidden forwarding rules, whether your domain can be spoofed (SPF, DKIM, DMARC), and the security settings of your Microsoft 365 account, checked by script, or your Google Workspace account, reviewed by hand against our checklist.
3. Computers & Servers
Every Windows workstation and server: missing updates, unsupported Windows versions, antivirus and EDR status, drive encryption on laptops, and who has admin rights.
4. Backups & Recovery
Whether a backup exists for every critical system, whether it lives somewhere ransomware can't reach, and when anyone last proved it restores.
5. Office Network
Devices nobody recognizes, outdated equipment still on the network, weak Wi-Fi encryption, and cameras sharing a network with your computers. Firewall age and updates, and whether guests have their own Wi-Fi, come from the interview.
6. Internet Exposure
What the outside world can see: services open to the internet, expiring certificates, and forgotten websites and web addresses that should have been retired.
7. People & Process
A short interview with the owner or office manager: how wire and invoice changes are verified, what happens when someone leaves, staff training, and written policies.
Insurance & Compliance Readiness
We show how you would answer the questions cyber insurance applications ask today, and flag where HIPAA, the FTC Safeguards Rule, PCI or government-contract requirements apply, so you know which answers you can honestly give.
Insurance Evidence Pack
A separate document for your insurance file. The 14 questions cyber insurance applications commonly ask, each answered Yes, No or Not verified, with what the answer rests on: the computers and accounts we examined, the findings behind any No, and the date we collected it. Answers that come from the interview, such as staff training and how bank-detail changes are verified, are marked as what you told us, not what we saw.
Your Action Plan
Every fix in priority order, with a price for the work and which of our plans would keep it fixed going forward. Yours to keep, whether you hire us or not.
How It Works
Five Steps, About Two Weeks
Light on your time: under an hour and a half in total, spread over the scoping call, a short interview and the walkthrough.
Step 1: Scoping Call
15 minutes. How many people and computers, which email system, any compliance or insurance deadlines. We confirm the price before anything else happens.
Step 2: Written Authorization
A short agreement that lists exactly what we will and won't look at, signed by the owner. Nothing is inspected without it.
Step 3: Data Collection
Usually one visit plus remote work. A read-only collection script runs once on each computer and leaves nothing installed, your email administrator signs in so we can read the security settings, and we sit down for a 20-minute interview. Each computer is needed for only a few minutes.
Step 4: Your Report
Ready within 5 business days of the visit and handed to you at the walkthrough: an executive summary, a score for each area, every finding explained in plain English, and a prioritized action plan with prices.
Step 5: Walkthrough
A 45-minute meeting, in person or by video, where we go through the report with you and answer questions. No pressure: the report is yours either way.
Then: Your Choice
Fix it yourself, have your current IT provider fix it, or have us fix it. Start a plan within 30 days of the walkthrough and the assessment fee is credited toward it.
Flat, Published Pricing
One Price, No Surprises
Priced by the size of your office, quoted on the scoping call, and credited toward your plan if you start a Bay Geeks maintenance plan within 30 days of your walkthrough.
Business Risk Assessment
$495 flat · up to 10 computers
Each additional computer or server: $25. Multi-location and 50+ seat offices quoted on the call.
Included
- All seven risk areas inspected and scored
- Microsoft 365 security review by script, or Google Workspace reviewed by hand
- Internet exposure check of your domain and office connection
- Owner / office manager interview
- Written report with prioritized, priced action plan
- Cyber insurance and compliance readiness summary
- Insurance evidence pack: 14 common application questions, each with its basis and date
- 45-minute walkthrough meeting
- Fee credited toward any plan started within 30 days of the walkthrough
Compare ongoing coverage on our Commercial Maintenance Plans page. Prefer paper? Download the one-page summary (PDF) to share with a partner or your insurance agent.
Request an Assessment
Rather Not Call?
Send a few details and we'll reach out to set up the 15-minute scoping call. Nothing is inspected until you sign a written authorization.
Common Questions
Frequently Asked Questions
How much does the assessment cost?
$495 flat for an office with up to 10 computers, and $25 for each additional computer or server. Multi-location offices and offices over 50 seats are quoted on the scoping call. If you start a Bay Geeks maintenance plan within 30 days of your walkthrough, the assessment fee is credited toward that plan.
Will it interrupt our work?
No. Collection runs in the background and each computer is needed for only a few minutes. The only time we need from you is the 15-minute scoping call, a 20-minute interview with the owner or office manager, and the 45-minute walkthrough of the report.
Do you change anything on our computers or accounts?
No. Every tool we use is read-only: no settings are changed, no software stays installed, and we do not collect passwords, files or the contents of anyone's email. One thing does remain: when your Microsoft 365 administrator signs in, Microsoft records an approval for its own command-line tool in your account. We show your administrator how to remove it afterward. Fixes only happen later, if you ask for them.
Is this a penetration test?
No. A penetration test tries to break in. This is an inspection: we examine how your systems are configured and what they expose, without exploiting anything or guessing passwords. It costs less than a penetration test and answers a different question: what is open, and what should be fixed first. If a contract specifically requires a penetration test, tell us on the scoping call.
What do you need from us?
A signed authorization that lists exactly what is in scope, a few minutes on each computer (in person or remotely), your email administrator to sign in once so we can read the security settings (you type the password, we never ask for it), and 20 minutes with the owner or office manager.
We already have an IT person or provider. Is that a problem?
Not at all. The assessment works well as a second opinion. The report is yours, and it is written so your current provider can act on it. A good provider will welcome it.
What if you find something serious?
You hear about it the same day by phone, not two weeks later in a report. Signs of an active compromise, such as a mailbox rule hiding messages or remote access open to the internet, are raised immediately.
Does the report satisfy my cyber insurance application, HIPAA or the FTC Safeguards Rule?
It shows how you would answer an insurance application today, based on what we observed and what you told us. The insurance evidence pack puts that in a separate document you or your insurance agent can work from: the 14 questions applications commonly ask, each answered Yes, No or Not verified, with what the answer rests on and the date. You still sign the application, and the pack describes what was true on the day we looked. The report is also strong input to the risk analysis HIPAA requires and the risk assessment the FTC Safeguards Rule requires. It is not a certification or a legal opinion, and we will not call it one.
What happens to the information you collect?
It is kept confidential, used only to produce your report, and deleted on request. The signed authorization spells out what is collected and how long we keep it.
Do we have to sign up for a plan afterward?
No. The report and action plan are yours to keep either way. You can fix things yourself, hand the report to your current IT provider, or have us do it.
Know Where You Stand
Book Your Business Risk Assessment
Fifteen minutes on the phone is all it takes to get started. We'll confirm your price and schedule the visit.
Need to run it past a partner or your insurance agent first? Download the one-page summary (PDF).