Promethos Cyber Services

Start the Pulse Check

Thirteen questions, about ten minutes. There are no wrong answers and nothing technical to look up. You get your result on the next screen.

About you
We review the results with you at no cost. This is where they go.
Governance and Human Risk
1. The Human Firewall. Does every employee receive security awareness training at least twice a year, including simulated phishing tests?
2. Identity Gatekeeping. Is Multi-Factor Authentication (MFA) mandated for every external-facing login (email, VPN, cloud portals)?
3. Access Lifecycle. Can you confidently say an employee's access to all systems is revoked within 24 hours of their departure?
Data and Asset Protection
4. The Crown Jewels. Do you have a formal data classification policy that defines who can access your most sensitive client or financial data?
5. Shadow IT. Do you have a vetted list of all SaaS applications your teams use, or are departments buying their own apps without IT oversight?
6. Device Control. If an executive lost their laptop at an airport today, is the hard drive encrypted, and can the data be wiped remotely?
Network and Infrastructure
7. Perimeter Integrity. Has your organization performed a professional penetration test or external vulnerability scan in the last 12 months?
8. Patch Management. Does your team have a documented process to update critical software vulnerabilities within 48 hours of a critical exploit being announced?
Resilience and Operations
9. The Boom Scenario. Do you have a written incident response plan that has been tabletop tested by leadership within the last year?
10. The Ransomware Safety Net. Both parts must be true to answer yes: (a) are your backups stored off-site and offline (immutable), and (b) have you successfully tested a full system restoration in the last 6 months?
11. Supply Chain Risk. Do you require your key vendors (payroll, cloud hosting) to provide an annual SOC 2 Type II report or equivalent security audit?
Secure Growth
12. Procurement and Development. Is security a formal requirement during the buy vs build phase of new software projects, or is it addressed only after the software is live?